OpenAI Daybreak and Anthropic Glasswing debut amid rapid gains in AI cyber capability
OpenAI launched Daybreak, a cybersecurity initiative built around GPT-5.5, a tiered Trusted Access for Cyber framework, and Codex Security as its agent harness, positioning it alongside Anthropic’s earlier Project Glasswing. Both programs advertise similar defender-focused uses, including vulnerability discovery, exploit validation in authorized environments, patch validation, and detection engineering, while differing mainly in governance and access controls. Major security vendors including Cisco, CrowdStrike, and Palo Alto Networks joined both efforts, signaling that large defenders are pursuing model-agnostic strategies rather than committing to a single AI provider.
The launches come as the UK AI Security Institute reported that autonomous AI cyber capability is advancing quickly, with the 80%-reliability cyber task time horizon previously doubling every 4.7 months and new results from Claude Mythos Preview and GPT-5.5 exceeding that trend. A newer Claude Mythos Preview checkpoint became the first model to complete both AISI cyber ranges, including the previously unsolved Cooling Tower, while GPT-5.5 also posted strong results on The Last Ones; AISI said benchmark differences between the leading models are now narrow enough that practical differentiation is shifting toward agent harnesses, access restrictions, auditability, and partner ecosystems. The institute warned that current tests likely understate real-world capability and urged organizations to strengthen security baselines as both the defensive value and the cyber risk of frontier models increase.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
7 events from the most recent confirmed update back to the earliest known activity.
Daybreak and Glasswing disclosed overlapping security partners
Reporting on Daybreak noted that Cisco, CrowdStrike, and Palo Alto Networks were partners in both OpenAI's Daybreak and Anthropic's Glasswing programs. The overlap suggested major security vendors were pursuing model-agnostic strategies rather than aligning exclusively with one AI provider.
OpenAI launched the Daybreak cybersecurity initiative
OpenAI launched Daybreak as a cybersecurity program built around GPT-5.5, a tiered Trusted Access for Cyber framework, and Codex Security as its agent harness. The initiative positioned OpenAI alongside Anthropic's earlier Glasswing offering for defender-focused AI security workflows.
Palo Alto says frontier AI research produced 26 CVEs across 130+ products
Palo Alto Networks reported that recent frontier AI models were highly effective at finding vulnerabilities and chaining them into critical exploit paths. The company said this work led to 26 CVEs covering 75 issues across more than 130 products, adding independent evidence of rapidly advancing autonomous cyber capability.
GPT-5.5 posted strong results on AISI's 'The Last Ones' benchmark
AISI reported that GPT-5.5 showed strong performance on The Last Ones and that new results for GPT-5.5 and Claude Mythos Preview substantially exceeded its prior trend estimate. The institute said it was still unclear whether this represented a temporary jump or a faster new rate of progress.
Claude Mythos Preview first completed both AISI cyber ranges
A newer Claude Mythos Preview checkpoint became the first model to complete both AISI cyber ranges, including the previously unsolved Cooling Tower challenge. AISI cited this as evidence that frontier autonomous cyber capability had advanced beyond its earlier trendline.
AISI published a February 2026 estimate of rapid cyber capability growth
In February 2026, AISI estimated that autonomous cyber capability was improving quickly, with the reliable cyber task time horizon doubling every 4.7 months. The estimate served as the prior benchmark before newer Claude Mythos Preview and GPT-5.5 results were evaluated.
Autonomous AI cyber task horizon began doubling from late 2024
According to the UK AI Security Institute, frontier AI models' 80%-reliability cyber task time horizon had been doubling every 4.7 months since late 2024 under a 2.5 million token limit. This established the baseline trend used to assess later model advances.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
6 references tracked. Mallory keeps watching after this page renders.
OpenAI Daybreak and the Future of Secure Software Development - Arctic Wolf
arcticwolf.com
Open sourceDaybreak and Future of Secure Software Development | Arctic Wolf
arcticwolf.com
Open sourceL'IA d'Anthropic progresse à une vitesse alarmante selon les expe ...
zdnet.fr
Open sourceResearchers say AI just broke every benchmark for autonomous cyber capability | CyberScoop
cyberscoop.com
Open sourceOpenAI's Daybreak and Anthropic's Glasswing have nearly identical benchmarks - and 3 of the same partners - The New Stack
thenewstack.io
Open sourceHow fast is autonomous AI cyber capability advancing? | AISI Work
aisi.gov.uk
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic Mythos Raises Alarm With Rapid Gains in AI Cyber Capability
Anthropic’s **Claude Mythos Preview** has been rolled out to a limited set of major technology and infrastructure firms under **Project Glasswing**, where partners including Amazon, Apple, Microsoft, Cisco, CrowdStrike, Palo Alto Networks, Broadcom, and the Linux Foundation are using it for defensive security work such as vulnerability discovery in first-party and open-source software. Anthropic said the model found **thousands of high-severity and zero-day vulnerabilities**, while Mozilla reported Mythos identified **271 Firefox flaws**, far above the 22 bugs previously found with an earlier Anthropic model. Mozilla said the findings suggest AI-assisted code reasoning is approaching the breadth of elite human vulnerability research, even if the bugs themselves were still understandable to human experts. Separate findings from the UK’s **AI Security Institute (AISI)** indicate that frontier models’ autonomous cyber capabilities are advancing faster than earlier forecasts and that common evaluation methods may be understating their performance. AISI reported the `80%`-reliability cyber time horizon has been doubling every **4.7 months** since late 2024, with Claude Mythos Preview and `GPT-5.5` outperforming that trend, and said Mythos became the first model to complete both evaluated enterprise cyber ranges, including the previously unsolved industrial-control scenario **Cooling Tower**. AISI also found that larger inference budgets—up to **50 million tokens** or **1,000 turns**—unlock materially higher success rates on difficult cyber tasks, reinforcing concerns that increasingly capable AI systems could strengthen defenders while also lowering the barrier to advanced offensive cyber operations if access is not tightly controlled.
Jun 29, 2026
GPT-5.5 Matches or Surpasses Mythos in Offensive Cybersecurity Tests
The UK’s AI Security Institute found that OpenAI’s **GPT-5.5** performed at or above the level of Anthropic’s **Mythos Preview** in offensive cybersecurity evaluations, underscoring a sharp rise in frontier-model cyber capability. In an AISI benchmark built around **95 Capture The Flag challenges**, GPT-5.5 reportedly led overall on advanced tasks with a **71.4%** score, ahead of Mythos Preview at **68.6%** and GPT-5.4 at **52.4%**. The tested scenarios included realistic security work such as firmware analysis without source code, exploitation of memory-corruption bugs including `use-after-free`, cryptographic bypass, attacks on weak random-number generators, and analysis of obfuscated malware. The results also showed limits: Mythos Preview reportedly remained stronger in longer, multi-step intrusion simulations, including a **32-step** exercise known as **“The Last Ones,”** and neither model completed a simulated industrial-system attack. Researchers and commentators said the findings point to rapid gains driven by greater autonomy, stronger reasoning, and improved coding ability, increasing concern over near-term misuse. Reports differed on deployment details, with some noting restrictions on GPT-5.5’s full public availability while others described the model as generally available, but the evaluations broadly agreed that leading AI systems are now highly capable at vulnerability discovery and offensive security tasks.
Jun 29, 2026
Anthropic Restricts Mythos AI After It Finds and Exploits Thousands of Software Flaws
Anthropic unveiled **Claude Mythos Preview**, an unreleased AI model it says can autonomously discover and exploit severe software vulnerabilities across major operating systems, browsers, open-source projects, and some closed-source targets. The company said the model uncovered thousands of high-severity flaws, including long-lived bugs in **OpenBSD**, **FFmpeg**, Linux kernel privilege-escalation chains, and **`CVE-2026-4747`**, a FreeBSD NFS remote code execution flaw that could enable unauthenticated root access. Anthropic withheld broad release, citing offensive cyber risk, and instead launched **Project Glasswing**, a gated program for roughly 40 to 50 partners such as AWS, Apple, Cisco, Cloudflare, Google, JPMorgan Chase, Microsoft, Mozilla, NVIDIA, and Palo Alto Networks to validate findings, patch affected software, and study defensive uses. Independent and industry assessments broadly agreed Mythos marks a significant advance in AI-enabled cyber capability, though several researchers questioned how much of Anthropic’s headline claims can yet be verified through public CVEs and warned that similar results may be reproducible with cheaper or open models plus strong tooling. The UK AI Security Institute found Mythos achieved a **73%** success rate on expert capture-the-flag tasks and completed a full 32-step simulated enterprise attack in 3 of 10 runs, while Anthropic later reported coordinated disclosure activity spanning **1,596 vulnerabilities across 281 open-source projects** and partners identifying more than **10,000** high- or critical-severity candidates. Governments, financial regulators, and CISO groups in the US, UK, Europe, Canada, and Japan responded with briefings and warnings that AI is compressing the gap between vulnerability discovery and weaponization, leaving remediation, patch governance, and defensive automation as the main bottlenecks.
Jun 29, 2026