OpenAI expands Daybreak defence service with new GPT-5.6-Cyber model
The AI laboratory’s latest offering includes GPT-5.6-Cyber, a defensive tool built on GPT-5.6 Sol, available exclusively to select enterprise partners.
OpenAI has widened the scope of its Daybreak cybersecurity defence programme, introducing a tiered service structure comprising Blue and Red packages. The expansion, announced on Monday, positions the service as a direct response to the multiplication of AI-led attacks, offering defenders access to purpose-trained models and enhanced workflows.
The new Blue tier is described by the company as the recommended starting point for most defenders. It bundles access to incident response capabilities, malware analysis, and patch validation. OpenAI suggests this package provides sufficient protection for the majority of enterprises facing current threats, serving as a foundational layer in their security strategy.
For more advanced requirements, the Red tier offers a broader toolkit designed for security testing and vulnerability research. This package grants users access to purpose-trained cybersecurity models and, notably, the newly launched GPT-5.6-Cyber. Built on the GPT-5.6 Sol architecture, the new model is engineered specifically for defensive security tasks, though its specific technical limitations remain unverified in public disclosures.
Access to GPT-5.6-Cyber is currently restricted to trusted customer partners. OpenAI has confirmed that the service is available to a select group of industry leaders, including Accenture, IBM, CrowdStrike, and Cloudflare. This limited rollout aligns with the company’s previous approach to deploying guardrails on its frontier models, which have faced scrutiny over safety concerns and potential rogue behaviour.
The launch follows Anthropic’s release of its cyber-focused model, Mythos, earlier this year, intensifying competition among AI laboratories to provide security solutions. While critics have suggested that AI-led cyber threats may serve as marketing opportunities for these labs, enterprises continue to seek protection from the companies that possess first-hand knowledge of their own model risks.
OpenAI’s blog post highlighted the urgency of the situation, stating that threat actors are increasingly using AI to conduct attacks at unprecedented speed and scale. The company warned that defenders have a narrowing window to prepare as these capabilities spread, framing the Daybreak expansion as a necessary evolution in the cybersecurity landscape.
Frontier models have been a subject of significant controversy, with the Trump administration previously seeking collaboration with AI companies regarding their rollout. OpenAI has historically deployed significant restrictions on customer usage of these advanced models, and the new Daybreak structure appears to formalise these controls within a commercial defence offering.
As the industry grapples with AI agents compromising platforms and engaging in social engineering, the move underscores a growing trend where enterprises purchase protection from the AI labs that create the underlying technology. This dynamic suggests a shift towards a model where the creators of potential threats also provide the primary defence mechanisms.
