OpenAI launches AI agents to find and fix software vulnerabilities

A new approach to security

OpenAI recently unveiled two new cybersecurity products, Daybreak Red Team and Daybreak Defense Factory, during its Cyber at the Frontier event. These tools represent a shift toward using AI agents to handle practical, hands-on security operations. The goal is to bridge the gap between discovering a security weakness and actually fixing it.

The Daybreak initiative focuses on using advanced AI capabilities for authorized cybersecurity work. Rather than just providing information, these products are designed to perform specific tasks like investigating attack paths. They aim to reduce the time it takes for a company to respond to a security threat.

According to OpenAI, these tools are meant to support security professionals rather than removing them from the process. The company emphasizes that humans will remain the ultimate decision-makers for all security actions. This approach seeks to make security teams more efficient without sacrificing oversight.

Automating the hunt for flaws

Daybreak Red Team is specifically built to perform AI-assisted penetration testing on web applications. It uses a coordinated group of AI agents that examine an application's source code and other contextual information. These agents then investigate possible attack paths to see if a vulnerability is actually exploitable.

Traditional penetration testing is often a slow and resource-heavy process for human experts. Daybreak Red Team aims to speed this up by assigning specific investigation tasks to AI agents. It can also look at existing reports from bug bounties and code scanners to see if a reported issue can be reproduced.

The tool also allows development teams to verify their own work. It can check whether a specific security patch actually prevents a previously identified exploit. This helps teams confirm that a code change truly resolved the problem instead of just assuming it did.

From discovery to remediation

While the Red Team tool finds problems, Daybreak Defense Factory is designed to help fix them. This product uses AI agents to trace vulnerabilities through application code and prepare potential patches. It is intended to help engineering teams move from a list of problems to a practical set of corrections.

Security teams often use many different tools to find weaknesses, but these alerts don't always explain how to fix the issue. Defense Factory attempts to reduce this workload by examining the findings and drafting the necessary code changes. It can work with findings from other products like Wiz, Snyk, and Endor Labs.

The system also connects with Codex to allow engineers to modify the proposed patches. It can even prepare draft GitHub pull requests for developers to inspect. However, these changes are not automatically merged or deployed, ensuring that engineers must test and approve them first.

Who benefits from these tools

These products could be particularly useful for smaller development teams that lack dedicated cybersecurity departments. In many small companies, developers have to balance security with building new features and providing customer support. These AI tools can help them manage a growing backlog of security alerts more effectively.

By automating the investigation of reported vulnerabilities, smaller teams can focus on the most critical issues. Defense Factory can help them work through a long list of findings without having to manually research every single one. This allows for a more organized approach to maintaining software safety.

However, OpenAI notes that these tools do not eliminate the need for human expertise. Organizations still need to manage repository permissions and data-handling requirements. Users must also consider the resources needed to test and validate the AI-generated changes before they go live.

Safety and human oversight

Because security testing involves sensitive systems, OpenAI has built-in boundaries for the Daybreak agents. Daybreak Red Team operates within isolated testing environments and uses a Guardian review to enforce restrictions. These measures ensure the agents only access applications and endpoints that the organization has explicitly authorized.

Human oversight is also a core part of the Defense Factory workflow. A generated patch might fix a specific bug but could also cause compatibility problems or affect other functions. Because of this risk, the system is designed to prepare drafts for review rather than deploying them automatically.

The success of these tools will depend on how accurately they find flaws and how well they integrate with existing workflows. For now, they are positioned as assistants that help professionals do their jobs faster. They represent a step toward a more automated, yet still human-controlled, security landscape.

Availability and next steps

The availability of these tools varies depending on the specific product. Daybreak Red Team is currently in an early access phase for interested organizations. This means companies must register their interest with OpenAI to begin using the penetration testing features.

Daybreak Defense Factory is available in preview for eligible workspaces that already have Daybreak access. It can be accessed through a ChatGPT plugin for these specific users. OpenAI has not yet announced public pricing for either of the new cybersecurity products.

As these tools move into wider use, the focus will be on how well they handle real-world development environments. Organizations will need to evaluate the accuracy of the AI's findings and the quality of its proposed patches. The goal remains to make cybersecurity more efficient by reducing repetitive manual work.

Try it today

If you are part of a development team, check if your organization is eligible for Daybreak access through OpenAI to explore the preview features.

Watch

How accurately the AI-generated patches perform in complex, multi-layered codebases.

Whether these tools become the standard for small companies without dedicated security teams.

The evolution of the 'Guardian review' system in enforcing AI boundaries.