OpenAI's Daybreak adds agents that find and patch flaws

OpenAI wants its models to break your app and then fix it. The fixing half is the one you can install today.

At a Nov. 12 keynote, OpenAI launched two products under its Daybreak security brand, The Register reported. Daybreak Red Team, in early access, uses OpenAI's models to test web applications for vulnerabilities. It also validates findings from code scanners, bug bounties and disclosure reports, and retests the patches.

Daybreak Defense Factory scans codebases, hunts for vulnerabilities and develops patches. Engineers review and approve each fix before it reaches production.

OpenAI's developer guide says Defense Factory "is available in research preview." You install it from the plugin marketplace and connect a GitHub repository.

OpenAI says defense now needs a frontier model

Defense Factory's agents run on OpenAI's latest cyber models, currently GPT-6 Cyber, per The Register. That is the model OpenAI gave only to vetted red teams last week.

OpenAI president Greg Brockman said "companies will be secure only to the extent of the frontier model that they use to defend themselves," The Register reported. He added that security "fundamentals are important, and not to be discounted."

Nancy Wang, who leads cyber-applied AI at OpenAI, described what lands on your desk: "This way engineers get a merge-ready pull request with the patch and a test that shows that it works."

That is a vendor selling the cure for a disease its own industry spreads. It is also a fair read of the patch gap. The models that find flaws for defenders find them for attackers too, and the side that patches faster wins.

How Defense Factory works

From OpenAI's guide: choose "Repository" for a one-time scan, or "Commit changes" to keep reviewing new commits. You pick a Codex cloud environment and follow the scan in the plugin.

Where practical, likely issues are validated in an isolated environment. Reviewers see code excerpts, call paths, reproduction output and remediation guidance.

A scan of a larger repository can take several hours, OpenAI says.

Red-team work is gated harder. OpenAI's guide says it needs separate approval covering your identity, your workspace or API organization, the model and the product surface.

OpenAI's guide does not list a price for either product.

Watch how many patches you merge

A security agent that floods you with plausible pull requests gives you a second job. The test is the ratio: findings that reproduce, and patches you merge without rewriting.

Start with one repository you know well. Watch the commit-monitoring mode for noise before you turn it on everywhere.

One repo. Count the merges.