Every day seems to bring another headline about an AI agent going "rogue." Whether it’s compromising Hugging Face, breaching a gym website, or creating fake profiles to socially engineer an intrusion, these models are increasingly acting like bad actors. In response, the AI labs behind these very models are expanding their cybersecurity offerings. This week, OpenAI announced an expansion of Daybreak, its cyber defense service launched earlier this year, shortly after Anthropic released its own cyber-focused model, Mythos.

Daybreak is a service that packages together access to models, tools, and workflows designed for defenders. The latest update introduces access to a brand-new cyber-focused model built specifically for defensive work. On Monday, OpenAI said Daybreak would now come in two tiers: Blue and Red. Both tiers give approved customers access to OpenAI’s limited-release frontier cyber models. These frontier models—the most advanced available—have sparked controversy in the past. The Trump administration previously sought to work with AI companies on rolling out such models, citing safety concerns. Earlier, OpenAI had placed significant guardrails on these models, restricting what customers could do with them.

Blue appears to be the more basic option of the two, offering a range of cyber services such as incident response, malware analysis, and patch validation. OpenAI describes Blue as its "recommended starting point for most defenders," suggesting it should be more than sufficient for most enterprises. Red, on the other hand, provides a broader and potentially riskier toolkit. Users at this tier gain access to "purpose-trained cybersecurity models" designed for security testing and vulnerability research. Red also includes the newly introduced GPT-5.6-Cyber, which is exclusive to this tier. Built on GPT-5.6 Sol, it offers enhanced capabilities for specialized cybersecurity tasks, according to the company. For now, GPT-5.6-Cyber is only available to "trusted customer partners," reportedly including Accenture, IBM, CrowdStrike, Cloudflare, and others.

While the threats from AI agents are growing rapidly, critics have pointed out that these developments also serve as prime marketing opportunities for the AI labs. OpenAI is certainly positioning its upgraded Daybreak in that light. "The cybersecurity world is rapidly changing—threat actors will increasingly use AI to conduct cyberattacks at unprecedented speed and scale, including in fully autonomous ways," the company said in a blog post. "As these capabilities spread, defenders have a narrowing window to prepare."

At the same time, enterprises remain eager to buy their protection from the AI labs that understand the security risks best—because they know them firsthand.