OpenAI launches Daybreak: AI as a corporate “ethical hacker”

What Daybreak is

Put simply, Daybreak works as an “automated ethical hacker.” OpenAI’s platform, unveiled on May 12, 2026, applies AI models to threat-model a company’s code, identify and test vulnerabilities in an isolated environment and propose fixes that have already been validated, returning audit-ready evidence.

Instead of only reacting after the damage is done, the idea is to let security teams simulate real attacks before criminals do, compressing into minutes analyses that used to take hours.

How it works in practice

1. Threat modeling
   The AI analyzes the code repository and maps where an attacker could get in.
2. Discovery and validation
   Vulnerabilities are identified and tested in an isolated environment to confirm whether they can really be exploited.
3. Proposed fix
   The system suggests the code change and runs new tests to confirm the flaw has been resolved.
4. Audit evidence
   The results go back into the company’s systems with a record of what was found and fixed.

Three levels of access

Model	For whom	Use
GPT-5.5	General use	Standard safeguards
GPT-5.5 with Trusted Access for Cyber	Verified defenders	Code review, vulnerability triage, malware analysis and fix validation
GPT-5.5-Cyber	Authorized environments	Red teaming, penetration testing and controlled validation, where the AI literally “thinks like an attacker”

Why access is restricted
The same capability that finds flaws to fix them can be used to exploit them. That is why the more permissive versions require the organization to be verified and the use to be authorized.

Who is already on board

OpenAI announced eight launch partners integrating Daybreak into their products: Akamai, Cisco, Cloudflare, CrowdStrike, Fortinet, Oracle, Palo Alto Networks and Zscaler. In practice, this means some of this intelligence should reach companies through security tools they already use.

The competitive landscape

This move is not happening in isolation. In April 2026, Anthropic introduced Project Glasswing, which uses the Claude Mythos model to identify vulnerabilities in critical software. Mozilla reported finding and fixing 271 vulnerabilities in a version of Firefox with the model’s help.

• Anthropic · Project Glasswing
  Access limited to a small group of partner organizations, treating the model as a dual-use technology that requires strict governance.
• OpenAI · Daybreak
  Gradual rollout to verified defenders, with proportional safeguards and a focus on fitting into companies’ development workflows.

What this changes for companies

For years, cybersecurity was treated as a necessary cost: teams reacting to threats, patching systems after attacks, trying to limit the damage. Tools like Daybreak point to a different model: proactive, data-driven, automated security built into the development cycle.

• Flaws are likely to be found and fixed faster, including by attackers, which shortens the window for applying updates.
• Continuous security testing becomes part of development, not just of yearly audits.
• Security vendors will build these capabilities into their products; it is worth asking how your partners are using AI.
• Governance is still essential: who authorizes the tests, what data the AI can access and how results are handled.

AI is not a shortcut around the basics
Timely updates, two-factor authentication, tested backups and trained people are still the foundation. AI amplifies the capabilities of teams that already have processes; it doesn’t make up for not having them.

How your company can prepare

• Inventory of the systems and code the company develops or maintains
• A process for patching quickly when a flaw is disclosed
• A defined AI usage policy, including for security tools
• Regular security testing led by experts
• Vendors assessed on their use of AI and data protection
• A team keeping track of how these technologies evolve

AI will not replace cybersecurity experts, but experts who use AI will outperform those who don’t.