OpenAI pushes AI deeper into cyber defence

OpenAI has launched Daybreak, a cybersecurity initiative designed to use frontier AI models and Codex Security to find software flaws, generate fixes and verify remediation before attackers can exploit weaknesses in code.

Daybreak marks a sharper push by the ChatGPT maker into defensive cybersecurity, where AI systems are being positioned not merely as coding assistants but as tools for secure-by-design software development. The service is built around the idea that security should be embedded at the start of the software lifecycle, rather than handled mainly through audits and emergency patches after deployment.

The initiative combines OpenAI’s models, Codex as an agentic framework and security partners across industry to support secure code review, threat modelling, patch validation, dependency risk analysis, detection and remediation guidance inside day-to-day development workflows. OpenAI says the system is intended to help defenders reason across codebases, identify subtle vulnerabilities, analyse unfamiliar systems and move faster from discovery to repair.

A central part of Daybreak is controlled access. OpenAI is offering different capability levels, beginning with GPT-5.5 under standard safeguards for general development and knowledge work. GPT-5.5 with Trusted Access for Cyber is aimed at verified defensive work, including vulnerability triage, malware analysis, detection engineering and patch validation. GPT-5.5-Cyber is being made available in preview for more specialised authorised workflows such as red teaming, penetration testing and controlled validation, with stronger verification and account-level controls.

The launch follows a broader acceleration in AI-assisted vulnerability research. Advanced models can now shorten the time needed to inspect large codebases, identify risky dependencies and test exploit paths, but the same capabilities can raise the stakes for defenders if malicious actors use similar tools. This tension is shaping the design of Daybreak, which pairs expanded defensive capability with safeguards, accountability and identity-based access.

OpenAI’s partner list for the initiative includes Cloudflare, Cisco, CrowdStrike, Palo Alto Networks, Oracle, Zscaler, Akamai and Fortinet. Several of these companies already operate large-scale security platforms, making their role important for testing how AI-driven remediation works across enterprise environments where software stacks are complex, distributed and subject to strict audit requirements.

Daybreak also lands amid growing competition among AI labs to serve the cybersecurity market. Anthropic has promoted Project Glasswing and Claude Mythos Preview as part of a controlled effort to help secure critical software. Anthropic’s own material says Mythos-class capabilities have reached a level where AI can outperform all but highly skilled humans at finding and exploiting software vulnerabilities, a claim that has intensified debate over how such tools should be distributed.

The commercial opportunity is significant. Companies are under pressure to reduce software supply-chain risk, meet tighter regulatory expectations and respond faster to vulnerabilities in open-source and proprietary code. Security teams often face backlogs of alerts, patch reviews and false positives, while developers are expected to ship code quickly without weakening controls. AI agents that can prioritise exploitable flaws, propose patches and produce audit-ready evidence could reduce some of that pressure if their outputs prove reliable.

The risks remain substantial. AI-generated vulnerability reports can be inaccurate, incomplete or overconfident, creating triage fatigue for maintainers already dealing with heavy workloads. Automated patching also carries operational risk when fixes alter live systems, introduce compatibility problems or miss secondary attack paths. For security leaders, the appeal of faster remediation will have to be weighed against governance, verification and human oversight.