OpenAI says SentinelOne used Daybreak to reduce an analysis task that previously took a top researcher four to six weeks to roughly eight hours. SentinelOne Chief AI Officer Gregor Stewart describes the resulting output as human-level; this is his characterization in OpenAI’s customer case, not an independently reported benchmark.
The mechanism: Shorter turnaround frees researchers to examine more samples and compare them for shared components and relationships, while human review remains for consequential architectural decisions. OpenAI’s account says SentinelOne previously had to reserve deep investigation for a small number of especially interesting or important samples. Broader comparison may surface connections that isolated investigations would miss. Stewart distinguishes point fixes that could be automated from architectural changes that still warrant human eyes. In this account, acceleration increases the work available for review rather than eliminating accountable review.
Why now: The case makes the operational consequence of cyber-capable models concrete in a specialized workflow where scarce researcher time limits coverage. The first implication: If the reported time reduction holds in practice, security teams may be able to widen sample coverage and prioritize follow-up based on relationships across threats, rather than investigating only a few samples deeply. The first watch condition: Whether SentinelOne reports measured outcomes across a broader set of samples, including how often cross-sample links lead to useful investigations and which decisions remain human-reviewed.
Evidence boundary: This is an OpenAI-published customer account with a quoted SentinelOne executive and a specific time comparison, but it supplies no independent evaluation, task-by-task methodology, error rate, or detail on how “human-level” output was assessed. The reported reduction should therefore be read as a customer claim, not a general benchmark for malware analysis or evidence that the workflow is autonomous.