OpenAI is expanding its Daybreak cybersecurity programme with Red Team and Defense Factory. The first product runs penetration tests on web applications, the second puts AI agents to work closing vulnerabilities.
OpenAI is expanding its security programme Daybreak with two new products. One hacks, the other protects. Both products use AI agents that scan an organisation’s source code. Red Team attacks applications to determine which vulnerabilities can actually be exploited. Defense Factory investigates vulnerabilities that have been found and writes a patch for them.
Daybreak Red Team tests web apps
Daybreak Red Team deploys a coordinated team of AI agents against web applications. The agents investigate attack paths based on the source code and the application’s context, and confirm vulnerabilities. They also re-test reports from code scanners, bug bounty programmes and researchers, so security teams can use evidence to decide what to fix first.
After a patch, Red Team checks whether the exploit still works, and that test can run again every time the application changes. Customers decide which applications and endpoints the agents may access. The tests run in isolated environments.
In effect, OpenAI is now selling as a product what it had already done by accident with its own overzealous AI agents. These have been known to escape from their poorly secured internal environments and then start hacking. That does bring vulnerabilities to light. In this controlled form, organisations can (hopefully) deploy that AI capability in a controlled way.
Defense Factory clears the backlog
Daybreak Defense Factory (lead image) is meant to clear the backlog of security issues. Organisations connect their repositories and the findings of their existing security tools or of Red Team to the platform. AI agents investigate each issue, trace the vulnerability through the code and propose a patch. Developers can first review and test that patch.
Developers can also make adjustments themselves with Codex, OpenAI’s coding agent. They add context, review the evidence and refine the patch while the agents keep working in the background. Defense Factory can also scan every new commit or run checks at set times.
Sign-up and early access
For the advanced cybersecurity capabilities of its models, OpenAI lets individuals and organisations sign up for Daybreak. The company vets every applicant and looks at how they intend to use the models. Daybreak Red Team is only available in early access for now, and interested organisations can register. For Defense Factory, companies contact OpenAI’s sales team. OpenAI has not yet announced pricing.