Security teams have long had more vulnerability reports than people to chase them down. OpenAI now wants to sell them software agents that do both halves of the job: try to break an application, then write the fix.
The company introduced Daybreak Red Team and Daybreak Defense Factory on Thursday at its Cyber at the Frontier keynote. Red Team runs penetration tests on web applications and checks whether reported flaws can actually be exploited. Defense Factory takes those findings, traces each one through the code and prepares a patch for an engineer to approve. Johannes Landgraf, OpenAI’s head of cyber, said Red Team “paves the path for us to dramatically expand the access to our frontier cyber models over time,” The Deep View reported.
Red Team puts what OpenAI calls “a coordinated team of agents” on a single application. The agents use source code and app context to investigate attack paths and confirm vulnerabilities. One agent coordinates the assessment, others investigate the code and reviewer agents check the results, according to The Deep View. Customers can also feed it findings from code scanners, bug bounty submissions and disclosure reports to prioritize what to fix, and rerun a test to confirm a patch stops the exploit. To keep the agents in bounds, testing happens in isolated environments, and Guardian review controls which applications and endpoints they can reach.
Defense Factory handles the repair side. It can pull in findings from Red Team or from other tools, including Wiz, Snyk and Endor Labs, SecurityWeek reported. It can also scan connected GitHub repositories, watch new commits and run scheduled checks. Engineers can examine the evidence behind a finding, adjust a proposed patch with OpenAI’s Codex coding agent and open a draft pull request. Nothing ships on its own. Engineers review and test proposed patches before merge, and SecurityWeek noted that patches are not deployed automatically.
OpenAI framed the launch around speed. “Attackers are able to move faster. I think we see that right now almost on a daily basis,” Landgraf said in the briefing. “Defenders also have to move faster at that.” Clint Gibler, who leads cybersecurity research at OpenAI, said the products are meant to supplement human red teams rather than replace them. “There’s always been a dearth of security expertise in the world,” he said. “Our ability to secure the world needs to scale.”
The products build on a run of security moves. OpenAI released GPT-6 Cyber last week, and earlier this month it brought in Hacktron, the research firm that found a flaw in its own sign-on system, to test how its products connect with third-party services. In the keynote, OpenAI President Greg Brockman said the industry needs “to build software in a fundamentally more secure way.” Fouad Matin, the company’s cyber preparedness and safety lead, said OpenAI aimed to make the tools “turnkey and easy to use” for organizations that “might not have the red team staff on hand.”
Access is limited for now. Red Team is in early access, and companies can register interest, though OpenAI says registering does not guarantee a spot. Defense Factory is available as a preview plugin for workspaces that already have Daybreak access, SecurityWeek reported. OpenAI has not said what either product will cost or when Red Team will open to a wider group of customers.
WebProNews is an iEntry Publication