OpenAI launches Daybreak to find vulnerabilities in code automatically

OpenAI has launched Daybreak, an initiative to automatically find and fix vulnerabilities in code before hackers attack. It is a direct response to Claude Mythos from Anthropic, which recently unveiled its own security-oriented AI.

How Daybreak works

Daybreak uses the AI agent Codex Security, which OpenAI launched back in March of this year. The agent analyzes an organization's source code and creates a threat model: a detailed analysis of possible attack paths hackers could use when trying to infiltrate a system or gain unauthorized access.

The key feature is that the system does not simply identify bugs through scanning, as SAST tools do. It then validates how dangerous they really are, checking whether a discovered vulnerability can actually be exploited under the real conditions of a specific application and infrastructure. This sharply reduces the number of false positives that usually make engineers' lives miserable.

After validation, Daybreak automates detection of the most critical classes of vulnerabilities and helps engineers prioritize fixes based on risk level and likelihood of exploitation.

What Daybreak includes

• Full analysis of the application's source code and architecture
• Threat models built on typical exploitation paths
• Validation of discovered vulnerabilities against real-world exploitation criteria
• Automatic detection of critical, high and medium risk issues
• Integration into the CI/CD development pipeline

Competition between OpenAI and Anthropic

The launch of Daybreak coincides with the appearance of Claude Mythos from Anthropic, a security-focused AI model that its creators consider too dangerous for public release and public demonstration. Anthropic chose not to release the model into open access or open APIs, and instead shared it only with selected partners under its own initiative, Project Glasswing.

It is a landmark moment in the history of AI security. The two largest AI companies have invested in security-oriented solutions and frameworks almost simultaneously. That signals that enterprise cybersecurity is becoming a key strategic market for AI firms. Both sides understand the reality: companies urgently need tools that find vulnerabilities before hackers do.

The difference in strategy is clear: OpenAI is going with a fully public product available to all Pro subscribers, while Anthropic chose a more conservative model with limited access and deep partnerships only with large corporate clients.

What this means

For developers and corporate IT teams, this is a radical change in the development cycle. Instead of waiting for a human code review or running expensive pen tests before a production release, engineers will be able to use an AI agent to catch critical vulnerabilities early, right while coding. This should sharply reduce the likelihood of successful attacks after release and save on incident response.

For OpenAI and Anthropic themselves, it is another step in the migration of AI models from research labs into practical business, where the money is real and the stakes are high.