OpenAI launches Daybreak security tools that pen-test apps and draft their patches

OpenAI on November 12 unveiled two products under its Daybreak cybersecurity platform at its “Cyber at the Frontier” keynote: Daybreak Red Team and Daybreak Defense Factory, putting AI agents to work on both sides of security — finding flaws and fixing them — while keeping human review in the loop.

Red Team: automated pen-testing that proves the flaw

Red Team is now in early access and open for applications. Teams of AI agents test a single web application together: they read the source code and application context, map out possible attack paths, then verify whether a weakness can actually be exploited, and test whether a fix works. Nancy Wang, who leads cyber-applied AI at OpenAI, described it at the keynote as “superhuman pen-test at the scale of automated continuous scanning.”

Defense Factory: tracing the root cause and drafting the patch

Defense Factory handles the other half of the job. Its agents take a finding — from Red Team or from tools a team already uses — trace it to its root cause in the codebase, and prepare a proposed fix with tests for engineers to review before anything is merged; the platform does not deploy fixes itself. It works with findings from Wiz, Snyk and Endor Labs, connects to GitHub repositories, and is available as a preview plugin inside ChatGPT for workspaces that already have Daybreak access.

The models underneath, and the price question

Both products run on OpenAI's specialist cyber models, including GPT-6 Cyber, released on November 5 and the first OpenAI model rated Critical for cybersecurity risk under the company's Preparedness Framework, alongside the defensive Daybreak Blue and the offensive Daybreak Red models. OpenAI has not announced pricing for either product: Red Team is available through an early-access application, and Defense Factory through a sales conversation. The Daybreak platform itself launched on June 22.

Automation on both sides of the attack

The launch means one company is now selling AI agents to both attackers and defenders: Red Team finds the flaws automatically, Defense Factory patches them automatically. OpenAI stresses that human review remains the gate before any patch is merged — but as agents gain access to full codebases and run for long stretches unsupervised, how companies scope their permissions and audit their actions will be the key question for adopters.

(Sources: OpenAI; The Register; SecurityWeek; GBHackers.)