OpenAI turned its cyber models loose on both sides of the security loop on November 12. At a keynote it called "Cyber at the Frontier," the company launched two products under its Daybreak security brand: Daybreak Red Team, a team of AI agents that penetration-tests web applications, and Daybreak Defense Factory, a ChatGPT plugin that traces each finding through the code and drafts the fix. The pitch, in the words of president Greg Brockman at the keynote, is that companies "will be secure only to the extent of the frontier model they use to defend themselves." The human, notably, still signs the merge.

The launch packages the capability OpenAI spent the last week demonstrating — its GPT-6 Cyber model, which it says validated 948 previously unknown Linux kernel privilege-escalation bugs — into products security teams can actually buy. One attacks; the other repairs. Neither is generally available yet, and neither has a published price.

Red Team: a pen test that proves the bug#

Daybreak Red Team sends a coordinated team of agents at a web application, armed with its source code and application context. Instead of running a scanner and handing over a list of possible problems, the agents work through attack paths, confirm which weaknesses are genuinely exploitable, and check the findings that already come in from code scanners, bug bounties and disclosure reports — then retest the patch to confirm the hole is actually closed.

Nancy Wang, who leads cyber applied AI at OpenAI, described it at the keynote as "superhuman pen-test at the scale of automated continuous scanning." The guardrails matter as much as the capability: testing runs in isolated environments, operators decide which apps and endpoints the agents may touch, and a Guardian review layer applies. Red Team is in early access — organizations apply rather than sign up — and OpenAI has published no pricing.

A red-glowing robotic probe tracing a vulnerability path through layers of code
AI-generated illustration: Daybreak Red Team traces an attack path through an application's code.

Defense Factory: the fix, drafted for review#

Defense Factory picks up where a finding ends. It ships as a plugin for ChatGPT on web and desktop, in research preview, for workspaces that already have Daybreak access. Connect a GitHub repository with a personal account, and its agents will run one-off scans, watch new commits on the default branch, or scan on a schedule. For each finding — its own, or one imported from Snyk, Endor Labs or Wiz — the agents trace the vulnerability through the code, reproduce it where practical, and prepare a patch with a test.

The part OpenAI stresses, repeatedly, is what does not happen next: nothing merges on its own. Engineers review each proposed patch, refine it with Codex, or open a GitHub draft pull request. The Register reports the agents behind it currently run on GPT-6 Cyber. Cloud scans are billed by token usage at plan rates, outside the plan's included allowance; free scanning credits do not expire. GitLab code needs a local scan or the Codex Security CLI in CI.

An engineer reviewing a patch proposal with a holographic AI assistant holding a shield
AI-generated illustration: an engineer reviews a patch drafted by Defense Factory before it ships.

The model underneath: GPT-6 Cyber#

Both products sit on the cyber model OpenAI introduced on November 5. Its system card reports a 48.45% intended-exploit success rate on the ExploitGym benchmark, against 42.43% for GPT-6 Astra — vendor-reported figures, not independent ones. The same research run validated 948 local privilege-escalation bugs in the Linux kernel. It is also the first OpenAI model rated Critical for cybersecurity risk under the company's Preparedness Framework — one reason access stays gated behind Daybreak enrollment rather than the general API.

OpenAI also teased an unnamed next cyber model on a keynote slide, with no published scores to go with it. Several viewers posted screenshots citing a higher ExploitGym figure, but with nothing in writing from OpenAI, that number is not worth repeating here.

Why it matters — and what to watch#

Security teams have never lacked findings. Scanners flag far more issues than are exploitable, and fixes queue up while engineers triage. What Daybreak sells is the loop: prove which findings are real, then draft a tested fix for each one, continuously. If the false-positive rate is low and the patches are good, teams can close vulnerabilities far faster. OpenAI has published no accuracy or false-positive figures for either product, so that claim is still untested in public.

Three things to watch: first, whether Red Team's findings feed Defense Factory in practice — the loop has to work end to end. Second, pricing and access: early access and preview mean most teams are still waiting, and token-billed cloud scans could get expensive on large repositories. Third, the trust question: the agents read your source, run in your environments, and draft code you will ship. Guardian review and human sign-off are the answer for now; the audit trail will have to prove it.

The deeper shift is structural: the attackers are already agents, and the defenders are now agents too. The question is no longer whether AI will do security work, but how much of it teams are willing to hand over — and what they keep for humans.

Sources#