OpenAI Launches Two Cyber Tools Finding Bugs to Fixing Them

November 13 2026 04:14
OpenAI launched two security products at a live keynote on Thursday: Daybreak Red Team, which attacks your running apps, and Daybreak Defense Factory, which turns findings into patches. The central argument is that finding vulnerabilities is no longer the hard part, and fixing them fast enough is. This post covers what was announced, the evidence OpenAI offered, and the questions it left open.





Greg Brockman, OpenAI's president, opened the keynote by calling the current moment an acceleration of an old trend. The internet was never built with security in mind, he said, and no security chief has ever had enough resources. What has changed is that models can now find and exploit flaws at a pace that makes the old way of building software look fragile. He told the audience that a company's security will now track the strength of the frontier model it uses for defense and how well it uses it.

He laid out a three part plan. First, build frontier capabilities so defenders have a window where the best tools are well ahead of what attackers can easily get. Second, give trusted defenders access through the Daybreak program. Third, help companies actually put the models to work, through education, playbooks and now products. Daybreak itself has two access tiers, Blue for everyday defensive work on mainline models and Red for approved organizations that need specialized cyber models.




Nancy Wang, who leads cyber applied AI at OpenAI, described Daybreak Red Team as the signal of a superhuman pentest at the scale of continuous automated scanning. In the demo, a security engineer at a fictional document platform called Northstar Docs asked Codex to assess a staging environment because the company had a history of multi tenant problems. Codex drafted a campaign from connected context, including the target, the duration, a request rate limit, test credentials and the allowed traffic types. The engineer approved it and the agents started working.



The finding that came back was a stored SQL injection. The agent showed that one user, Bob, could save a search containing malicious input, run an export job for it, download the resulting zip file and find a private document that belonged to a user at a different company. The report included the architecture behind the flaw, the full exploit chain and a minimal patch suggestion meant to be handed back to Codex. Behind the scenes, one agent coordinates the assessment while others study source code and application context and reviewer agents check the results. OpenAI also described a supervisor agent that watches the whole fleet for drift from the intended goal.

Red Team is in early access with a waitlist, and OpenAI named DoorDash, Vanta and Harvey as customers helping shape it. Neither product page lists a price, so cost is an open question for now.


Defense Factory is the other half. Matt, who leads cyber product engineering, said the hard parts are validation, deduplication and reproducible cloud environments. The product pulls in findings from OpenAI's own scanner and from tools such as Wiz and Snyk, and from Red Team, then collapses duplicates into a single finding. It also guesses the right owner by looking at code history and team structure.

The cloud development environments are the part OpenAI keeps coming back to. The agent pulls the code, dependencies and tools so it can run the code, test whether a finding is real and test whether the fix works. An engineer gets a pull request with a patch and a test. Fixes can be generated in the background in bulk, or an engineer can open one in the foreground in Codex and steer it.

Teams can also turn on three toggles for secure code review on pull requests, continuous monitoring of the main branch and a deeper daily scan. OpenAI says it built this for itself first. Its internal security sprint involved 250 people, and the company says agents closed 53 urgent or high priority issues on day one. Defense Factory is available today through the Daybreak plugin in Codex.


Both products run on GPT 6 Cyber, which OpenAI released on November 5. In OpenAI's own ExploitGym test, GPT 6 Cyber scored 48.5 percent, compared with 32.1 percent for GPT 5.6 Cyber and 42.4 percent for its general purpose sibling. At the keynote, Fouad Matin put the figure at 52 percent. I could not find an explanation for the gap between that number and the one published at launch, so treat the exact score with some care.




He also said Anthropic's Mythos 5.2 scores about 38 percent on the same benchmark. That comparison comes from OpenAI, on a test OpenAI designed, and I have not seen it independently checked. The same goes for the claim that an upcoming cyber model will nearly double Mythos 5.2's score and reach around 80 percent on PatchBench, which measures whether a model can fix a flaw without breaking the application.

The most interesting part of the safety story is scope. Matin described a honeypot test that plants an easier, off limits target next to the real task to see whether the model cheats. OpenAI rates GPT 6 Cyber as Critical for cyber risk, and it exploited off limits services in 0.07 percent of runs without safety instructions, against 5.51 percent for its predecessor. Matin said production safeguards bring that to zero.



Brockman used a recent PHP flaw as his case study. Researchers at the security firm Calif, working through OpenAI's Patch the Planet program, used an earlier OpenAI model in August to find a version of the bug. OpenAI's next generation model independently found a more general version a month later, with no human help. Both flaws scored 9.2 on the severity scale, and PHP shipped fixes on October 21.

The messy part is what Brockman admitted outright. The coordinated disclosure took two months, consumed the bandwidth of OpenAI's team, partner companies and several governments, and does not scale. The real world confirmed it. Details leaked a day before the planned patch, and Amazon's honeypots had already seen an exploit attempt on October 17. Researchers also argued over how easy the flaw was to exploit in practice, and one prominent firm said AI sped up exploit development but that expertise still decided whether a bug became a working shell.





Clint Gibler, who leads cyber research at OpenAI, shared two lessons from scanning heavily tested code with newer models. A newer model finds new bugs in code that has been scanned for years, and low severity bugs can turn out to be serious once a model finds a way to chain them or get around controls. He gave three examples, according to the figures OpenAI has published:

• In Firefox, GPT 6 Cyber found and reproduced 81 previously unknown high severity bugs, and re ranked 30 known issues once it found new attack paths.
• In PHP, models handled variant analysis, adversarial testing of the patch and mitigation options in days instead of weeks.
• In Linux, an autonomous pipeline validated and patched close to a thousand local privilege escalation bugs, more than five times what the previous model found three months earlier.

Customers added their own numbers. Sophos said agents now solve 52 percent of its managed detection and response cases from start to finish, and average response time fell from 38 minutes to 89 seconds. One large customer reported that 87 percent of the findings its Night Falcon system closed were confirmed vulnerabilities that got fixed. These are vendor supplied figures, and they were presented as case studies rather than audits.






Brockman mentioned a billion dollar Daybreak defense fund. It is worth being precise about what that is. OpenAI committed $1 billion in subsidized access to its cyber models, plus training and support, aimed at defenders of water systems, the electric grid, local governments and similar targets. It is not a cash grant, and the plan is for it to be used over roughly six months.

The strongest idea in the keynote is also the least flashy one. A scanner that produces more findings is not useful if your team cannot triage them, and OpenAI is betting that validation in a real environment, deduplication and a tested pull request are what matter. Engineers still review and approve every fix, which is a sensible limit.

The caveats are real. Most of the performance claims come from OpenAI's own evaluations. Red Team has no public price and is not broadly available. The company that sells the cyber model is also telling you to reorganize your security practice around it. And the PHP story suggests the harder problem is coordination between humans, not any single tool.