OpenAI launches AI agents to test web apps and write security patches

New tools for cyber defense

OpenAI recently debuted two new cybersecurity products under the Daybreak brand. These tools were first presented during the company's Cyber at the Frontier event on November 12. The new offerings are designed to help security teams manage the constant cycle of finding and fixing software flaws.

The two products serve different roles in the security pipeline. Daybreak Red Team is built for the initial phase of finding weaknesses, while Daybreak Defense Factory focuses on the subsequent work of repairing those issues. Together, they aim to streamline how organizations protect their web applications from potential attacks.

By utilizing AI agents, OpenAI is moving toward a more autonomous model of security. These agents are capable of performing complex tasks that previously required significant manual effort from human security researchers. The goal is to provide a more consistent and scalable way to defend digital infrastructure.

How Red Team finds flaws

Daybreak Red Team functions as an automated penetration testing tool. It uses multiple AI agents to scan web applications for security weaknesses. These agents do not just look at the surface; they use the application's source code and specific context to understand how an attacker might move through a system.

The tool is designed to ingest a wide variety of data sources. It can examine findings from automated code scanners, bug bounty submissions, and official vulnerability disclosure reports. This allows the AI to cross-reference different types of security data to confirm which threats are actually valid.

To ensure safety, OpenAI stated that the agents operate in isolated environments. A system called Guardian review enforces testing boundaries. This ensures the AI only accesses the specific applications and endpoints that the security team has authorized for testing.

Automating the repair process

Once a vulnerability is identified, Daybreak Defense Factory takes over the remediation process. It is designed to help organizations address the specific flaws found by Daybreak Red Team or other existing security products. The agents trace the vulnerability through the code to understand its root cause.

The product can then develop patches to fix the identified issues. It supports importing vulnerability information from established platforms like Wiz, Snyk, and Endor Labs. It also has the ability to scan connected GitHub repositories and monitor new commits to stay updated on code changes.

Engineers can use the tool to examine the evidence supporting a security finding. They can also modify the proposed patches using Codex, which is a model for code generation. Finally, the system can create draft GitHub pull requests, though it does not deploy any patches automatically without human intervention.

Who can use these tools

OpenAI is currently managing access to these new products in a controlled manner. They are accepting specific requests from interested parties for early access to Daybreak Red Team. This suggests a phased rollout where early adopters can provide feedback on the AI agents' performance.

Daybreak Defense Factory is available through a preview plugin in ChatGPT. This plugin is specifically for workspaces that already have Daybreak access. This integration allows security engineers to use the tools within their existing workflow for managing code and security tasks.

The tools are primarily aimed at organizations with complex web applications and large codebases. By automating the investigation of attack paths and the drafting of patches, these products help teams manage the high volume of security alerts they receive daily.

The future of AI security

The introduction of Daybreak marks a shift toward 'agentic' security. Instead of just providing a list of bugs, the AI is now performing the work of investigating those bugs and proposing solutions. This reduces the time between a vulnerability being discovered and a fix being ready for deployment.

Security teams will still play a critical role in this new workflow. Because patches are not deployed automatically, engineers must review and test every proposal before it is merged. This human-in-the-loop approach ensures that the AI's suggestions do not break the application's functionality.

As these tools become more integrated into development pipelines, the speed of software patching will likely increase. Organizations will be able to respond to threats more quickly by leveraging AI to handle the repetitive tasks of code tracing and patch drafting.