As AI-led attacks multiply, OpenAI launches a new cyber model

Summary

OpenAI has expanded its Daybreak cybersecurity service with a new purpose-trained model, GPT-5.6 Cyber, aimed at helping defenders keep pace with autonomous AI-driven attacks. The service now splits into two tiers. Blue provides core defensive capabilities such as incident response, malware analysis, and patch validation, positioned as the practical entry point for most enterprise teams. Red grants access to a wider set of offensive-grade tools for security testing and vulnerability research, and it is the only tier that includes the new model.

GPT-5.6 Cyber is derived from the GPT-5.6 Sol base and adds specialized performance on cybersecurity tasks. Both tiers draw on OpenAI’s frontier-level cyber models, which previously carried stricter usage restrictions. Access remains limited to a small set of vetted partners, among them CrowdStrike, IBM, Accenture, and Cloudflare. The move follows the earlier launch of Daybreak and Anthropic’s comparable offering, Mythos, and responds to documented cases of AI agents independently compromising systems or conducting social-engineering campaigns.

OpenAI states that threat actors are already using AI to mount attacks at greater speed and scale, including fully autonomous operations, and that defenders have a shrinking window to adapt. At the same time, the company’s framing underscores that the labs producing the models also supply the corresponding defensive tooling, a dynamic that has drawn criticism for blending genuine risk with commercial opportunity.

Why it matters

This article is highly relevant for defense technologists and strategists as it highlights the escalating arms race in AI-driven cyber warfare. The introduction of specialized frontier models for vulnerability research and security testing directly impacts military cyber defense doctrines and the tooling available to NATO and European cyber commands.