OpenAI has launched two new access tiers for cybersecurity professionals through its Daybreak program, designed to let defensive teams use AI models without triggering the same restrictions that block malicious activity. The company introduced Daybreak Blue for standard defensive work and Daybreak Red for advanced security research, giving managed service providers and security teams specialized tools as clients demand help protecting AI-driven systems. Both tiers remain available only to vetted individuals and organizations under strict access controls.
Daybreak Blue offers general-purpose models including GPT-5.6 Sol without the cyber screening applied to standard deployments, supporting incident response, vulnerability management, secure code review, malware analysis, and patch validation, though it can still decline highly dual-use requests. Daybreak Red provides GPT-5.6-Cyber, a model built for authorized penetration testing and advanced vulnerability research with fewer refusals than the general-purpose version. During testing, the Red-tier model reportedly discovered two previously unknown V8 vulnerabilities that could be combined, and Google subsequently patched one as CVE-2026-15903.
According to the report, Daybreak access requires identity verification and account-security measures, with usage monitored under restrictions for authorized work only. OpenAI suggests isolated environments and defined authorization scopes, keeping human oversight for higher-risk activities. Early-access users include security vendors such as SentinelOne and Palo Alto Networks, exposing the program to established enterprise security workflows. The report notes that MSPs and MSSPs should establish customer scope before adding Daybreak to managed services, with contracts and runbooks identifying which systems can be tested and who can authorize advanced actions.
The report emphasizes that providers need to maintain enough activity records to review what the model performed during an engagement or incident, applying the same documentation discipline used for other privileged security tools. Teams lacking offensive-security specialists shouldn't view Red as a shortcut into penetration testing or exploit research, the report warns. Smaller MSPs can stay within services they already offer and bring in a specialist MSSP when an engagement exceeds their capabilities, particularly as providers weigh AI adoption against customer security. Access that exceeds a provider's expertise or customer authorization creates risk faster than it creates a new service, the report concludes. For managed providers navigating this shift, the operational challenge isn't whether AI can perform security tasks but whether the provider's governance structures can keep pace with what the technology enables them to attempt. The boundary between legitimate tooling and operational overreach has become a contractual question as much as a technical one.