What is OpenAI Daybreak?

Daybreak is a new OpenAI security initiative aimed at changing the way software is built and protected. The company unveiled it on May 11, 2026, just a month after competitor Anthropic announced its own program Project Glasswing with the Claude Mythos Preview model. While Anthropic did not release its model publicly for safety reasons, OpenAI decided to take the path of gradual and controlled access expansion.

According to OpenAI's official announcement, "Daybreak brings together the most capable OpenAI models, Codex, and our security partners" with the goal of accelerating the work of cyber defenders. The platform can analyze an organization's code, create a so-called threat model, focus on likely attack paths, validate vulnerabilities, and subsequently automate the detection of the riskiest ones. In practice, this means that AI can find and help fix security holes before real attackers discover them.

How Daybreak works in practice

The technological core of the initiative is the Codex Security agent, which OpenAI launched back in March 2026. This agent creates custom-tailored security models based on an organization's specific code. It is therefore not a generic scanner, but a tool that understands the context of a given application and its dependencies.

OpenAI states that Daybreak covers the entire security lifecycle: from secure code review through dependency analysis, threat detection, to patch generation and validation. The results are then fed back into the company's development systems with auditable evidence that the fix actually works.

Three access levels for different scenarios

A key element of Daybreak is the Trusted Access for Cyber (TAC) system, which divides users into three categories based on permissions and usage:

• GPT-5.5 (default): Standard protective mechanisms for general use. Suitable for regular development and education.
• GPT-5.5 with Trusted Access for Cyber: A model with more precise guardrails for verified defensive work in an authorized environment. It can perform security reviews, malware analysis, vulnerability triage, and patch validation. This level is intended for most security teams.
• GPT-5.5-Cyber (preview): The most permissive model for specialized authorized workflows, including red teaming and penetration testing. Access is limited to selected partners protecting critical infrastructure and requires advanced account security verification.

OpenAI emphasizes that even with extended permissions, safeguards against misuse remain in place, such as credential theft, malware deployment, or exploitation of third-party systems. From June 1, 2026, Advanced Account Security with phishing resistance will be mandatory for access to the most powerful models.

Comparison with Anthropic Claude Mythos

Anthropic revealed Project Glasswing on April 7, 2026. It includes the Claude Mythos Preview model, which according to the company discovered "thousands of serious vulnerabilities, including in every major operating system and web browser." Anthropic has not publicly released the model, arguing that it is too dangerous, and restricted access only to selected partner organizations, including Nvidia, Google, AWS, Apple, Microsoft, JPMorgan Chase, and Cisco.

OpenAI chooses a different strategy. Instead of one "closed" model, it offers Daybreak as a more open ecosystem, where different levels of capability are made available gradually based on identity verification and purpose of use. While Anthropic offers access mainly to large corporations and institutions, OpenAI allows individual verified security experts to request Trusted Access directly at chatgpt.com/cyber. Enterprise teams can then request access through their OpenAI sales representative.

Both companies nevertheless share the same vision: to use the most advanced models to accelerate defensive operations and narrow the time window between vulnerability discovery and its fix.

Partners and practical impact

OpenAI has formed partnerships with leading players in cybersecurity for Daybreak. Technology partners include Cloudflare, Cisco, CrowdStrike, Palo Alto Networks, Oracle, Zscaler, Akamai, Fortinet, as well as firms specializing in vulnerability detection and research such as SentinelOne, Qualys, Rapid7, Tenable, Trail of Bits, Snyk, and Semgrep.

These partnerships have a concrete impact on practice. Network and security providers can, for example, deploy temporary WAF (Web Application Firewall) rules and other mitigations before all affected systems are patched. Software dependency management tools can prevent vulnerable or compromised packages from reaching the production environment. EDR and SIEM partners can more quickly detect attempts to exploit newly discovered bugs.

OpenAI is also launching the Codex for Open Source program, under which selected maintainers of critical open-source projects will receive conditional access to Codex Security along with API credits, intended to facilitate maintenance and security reviews.

What does this mean for Czech companies and users?

For the Czech market, Daybreak brings several interesting impulses. Above all, it confirms the trend that large language models are becoming a standard part of security teams. Czech companies, banks, energy companies, or state institutions that already use ChatGPT Enterprise or API can relatively smoothly integrate new capabilities into their workflows.

The service availability is global, but subject to identity verification and intended use. Individual experts can sign up for the Trusted Access for Cyber program directly, organizations through their sales representative. It should be noted that specialized security models are primarily optimized for English, although the base GPT-5.5 supports Czech.

From a regulatory perspective, such powerful tools for cybersecurity fall under the scope of the EU AI Act, especially when deployed in critical infrastructure. The Czech National Cyber and Information Security Authority (NÚKIB) and European agencies such as ENISA will likely monitor how OpenAI and Anthropic address dual-use risks — namely, that these tools do not fall into the hands of attackers.

Conclusion

With the introduction of Daybreak, a new chapter in the use of artificial intelligence in cybersecurity has definitively begun. OpenAI has bet on a strategy of gradual and verified capability disclosure, which has the potential to appeal to a broader spectrum of defenders than the competitor's closed model. For Czech technology companies and security teams, this means a new powerful tool that — with responsible deployment — can significantly increase the resilience of their systems against increasingly sophisticated threats.