OpenAI Turns Its Cyber Models Into Products: Daybreak Red Team Attacks Your Web Apps, Defense Factory Writes the Patches
OpenAI launched Daybreak Red Team and Daybreak Defense Factory on November 12 at its Cyber at the Frontier event. Red Team, in early access, sends coordinated agents that use source code and app context to test web applications, validate reported vulnerabilities and check whether patches hold, within operator-set scope controls. Defense Factory uses agents built on GPT-6 Cyber, according to The Register, to trace vulnerabilities and prepare patches that engineers review before merging. OpenAI published no pricing or independent performance results for either product.
This month OpenAI has published what its cyber models can break. Now it is selling the same capability as two products, with a blunt pitch from its president. "We're now at a point where companies will be secure only to the extent of the frontier model that they use to defend themselves and how well they utilize that," Greg Brockman said at OpenAI's Cyber at the Frontier keynote on November 12, as quoted by The Register. That is a vendor's argument for buying its tools, not a finding.
Daybreak Red Team#
Daybreak Red Team, in early access, puts "a coordinated team of agents" to work testing a customer's web applications, OpenAI's product page says. The agents use source code and app context to investigate attack paths and confirm vulnerabilities. The product also tests findings from code scanners, bug bounty submissions and disclosure reports, and checks whether a patch actually stops an exploit. Customers control which apps and endpoints the agents can reach, with isolated environments and what OpenAI calls Guardian review.
Nancy Wang, who leads cyber-applied AI at OpenAI, described it as "superhuman pen-test at the scale of automated continuous scanning," The Register reported.
Daybreak Defense Factory#
Daybreak Defense Factory takes findings from a customer's security tools and from Red Team, and agents trace each vulnerability through the code and develop a patch, OpenAI says. Engineers review and test the proposed patches before they are merged, and can refine them with Codex. It can also scan new commits or run scheduled checks. The agents are built on OpenAI's latest cyber model, currently GPT-6 Cyber, according to The Register. "This way engineers get a merge-ready pull request with the patch and a test that shows that it works," Wang said.
GPT-6 Cyber is the model OpenAI rated Critical for cybersecurity under its Preparedness Framework this month and opened first to select Daybreak Red customers.
Limits#
- OpenAI's pages give no pricing, availability dates beyond early access for Red Team, or customer results; "superhuman" is OpenAI's own description.
- We have seen no independent evaluation of either product's detection rate, false positives or patch quality.
- The model behind Defense Factory is as The Register reported it; OpenAI's product page does not name a model.
- Reports on social media of a further, unreleased OpenAI cyber model and its benchmark scores were not confirmed in any OpenAI material we read, so we have left them out.