AI systems are no longer just tools for defenders. Increasingly, they are being turned into weapons. Recent incidents have seen autonomous agents probing corporate networks, compromising developer platforms, and spinning up fake online personas to trick employees into handing over credentials. The same technology that accelerates software development is now accelerating cybercrime.

In response, OpenAI is expanding its Daybreak cyber defense service, positioning it as a direct counter to AI-enabled attackers. Daybreak bundles OpenAI models with specialized tools and workflows aimed at security teams, promising faster detection, analysis, and remediation of threats.

The revamped service is split into two tiers, Blue and Red, both of which provide access to OpenAI’s tightly controlled frontier cyber models. These advanced systems have long been controversial because of their dual-use nature: the same capabilities that can help defenders find vulnerabilities can also help attackers exploit them. OpenAI has historically wrapped these models in strict guardrails, limiting who can use them and for what purposes.

Daybreak Blue is pitched as the default option for most organizations. It focuses on classic defensive tasks such as incident response, malware analysis, and patch validation. The idea is to give enterprise security teams an AI assistant that can triage alerts, reverse-engineer suspicious files, and verify whether a newly deployed fix actually closes a hole.

Daybreak Red goes further, offering what OpenAI describes as “purpose-trained cybersecurity models” for security testing and vulnerability research. This tier is designed for highly mature security teams and offensive security specialists who run penetration tests and red-team exercises. It is here that OpenAI is introducing its newest model, GPT-5.6-Cyber.

Built on the GPT-5.6 Sol family, GPT-5.6-Cyber is tuned for specialized cybersecurity tasks, from analyzing complex exploit chains to modeling how an autonomous attacker might move through a network. OpenAI is restricting access to a small group of “trusted customer partners,” reportedly including major consultancies and security vendors such as Accenture, IBM, CrowdStrike, and Cloudflare.

The move underscores a growing tension in the industry. As AI-driven threats escalate, the labs building the most powerful models are also selling the most advanced defenses. Critics argue that each new AI scare doubles as a marketing moment. OpenAI, for its part, frames Daybreak as a race against time, warning that defenders have only a shrinking window to prepare for fully autonomous cyberattacks.