OpenAI says SentinelOne uses Daybreak for malware analysis

OpenAI published a customer case study on October 14 saying SentinelOne uses Daybreak to reverse engineer malware. SentinelOne Chief AI Officer Gregor Stewart said the system produced, in roughly eight hours, work that previously took a top security researcher four to six weeks. The comparison has not been independently verified.

The case study says Daybreak examines software to determine how it behaves. That gives SentinelOne capacity to analyze more malware samples and compare findings across threats. The companies do not disclose the sample set, task definition, hardware, model configuration, evaluation rubric or repetition count behind the time comparison or Stewart’s characterization of the output as human-level.

SentinelOne said in a September 3 announcement that expanded Wayfinder Frontier AI Services would use Daybreak models for code-risk, compromise-assessment and malware-analysis capabilities. The company described workflows combining disassembly, deobfuscation, static evidence and sandbox evidence, with SentinelOne security analysts validating findings before delivery.

Wayfinder Frontier AI Services was generally available, SentinelOne said, while the new capabilities and expanded model lineup featuring Daybreak were rolling out in private preview, with broader availability to follow. The companies’ materials do not establish whether the internal workflow in the October case study is the same as those customer-facing preview capabilities.

Human oversight remains part of the documented process. OpenAI describes Daybreak as keeping access and action under human control, with consequential changes and deployed fixes receiving human review or independent verification. For context, DataPhoenix has also covered a separate Daybreak security workflow at Block that keeps people involved in remediation and deployment.

Stewart said architecture-changing decisions should still receive human review, while smaller point fixes may be better suited to automation: “The only thing that can’t be automated is accountability.”