OpenAI launches Daybreak to automate security testing and vulnerability patching

The Daybreak framework

OpenAI is expanding the role of AI in software security with the launch of Daybreak. This new suite of tools introduces AI agents designed to handle both the discovery of security weaknesses and the subsequent remediation of those flaws. By pairing these two functions, OpenAI aims to create a more cohesive pipeline for protecting software applications.

The system is built around two primary offerings: Red Team and Defense Factory. These tools are designed to work in tandem to connect the work of identifying a vulnerability with the technical task of patching it. This integration helps security teams move faster by ensuring that once a problem is found, the path to fixing it is immediately established.

According to Help Net Security, the goal is to bring AI agents into more of the software security process. Rather than just acting as a chatbot for questions, these agents are designed to interact with source code and context to perform specific, actionable security tasks.

Automated penetration testing

The Daybreak Red Team component is currently available through an early-access program. It utilizes coordinated agents to examine an application's source code and its surrounding context to find potential attack paths. These agents are capable of investigating how a hacker might move through a system to reach sensitive data.

One of the primary functions of Red Team is its ability to validate external reports. It can take findings from bug bounty submissions, vulnerability disclosure reports, or standard code scanners and confirm whether the vulnerability is actually exploitable. This helps security teams prioritize their repairs by providing concrete evidence of real risks.

To ensure safety, OpenAI states that assessments run within defined boundaries. These include isolated environments and a Guardian review process, which controls which specific applications and endpoints the agents are allowed to reach during their testing phase.

Remediation and patching

While Red Team focuses on finding problems, Defense Factory handles the remediation side of the equation. Agents within this tool investigate findings from existing security tools or the Red Team's results to trace vulnerabilities through the code. Once the flaw is traced, the system prepares proposed fixes for the development team.

Human engineers remain in the loop for the final stages of the process. They are responsible for reviewing and testing the patches before they are merged into the main codebase. During this phase, teams can use Codex to examine the evidence provided by the AI, add extra context, and refine the proposed changes.

The Defense Factory is accessible as a plugin in ChatGPT for teams with authorized access. Users can connect a GitHub repository to the tool, allowing the AI to interact directly with the code that needs to be secured.

Scanning and deployment

Teams can choose how they want to scan their repositories based on their specific needs. The system supports running scans on an entire repository's default branch, or it can be narrowed down to specific folders and files. This flexibility allows for targeted security checks on high-risk areas of an application.

The tool also supports monitoring new commits on a default branch to catch issues as they are introduced. It can schedule recurring scans or enable security reviews of pull requests before any changes are merged into the main project. This proactive approach helps prevent new vulnerabilities from entering the production environment.

For developers working locally, the desktop app supports scans of local checkouts and uncommitted changes. There is also an optional Deep scan mode available. This mode takes more time and uses additional tokens to perform multiple passes on the code for a more thorough investigation.

The future of security

The introduction of Daybreak represents a shift toward autonomous agents in cybersecurity. By automating the tedious work of tracing code paths and drafting patches, the tool aims to reduce the burden on human security professionals. It allows them to focus on high-level strategy and final verification rather than manual code auditing.

As these agents become more integrated into the development lifecycle, the speed of vulnerability disclosure and repair is expected to increase. The ability to validate bug bounty reports automatically could also change how companies interact with the broader security research community.

OpenAI's move suggests that the next phase of AI in software development will be defined by these types of specialized agents. These tools are not just writing code; they are actively participating in the defense of software infrastructure by identifying and neutralizing threats.