A bug report is only useful if someone can say whether the bug is real and how to close it. OpenAI is trying to automate both halves with two additions to its Daybreak security platform, announced on 12 November: Red Team, now in early access, and Defense Factory.
Red Team goes after web applications. Rather than hand over a scanner’s list of maybes, its agents work out whether an attacker could actually reach a weakness and what it would let them do. OpenAI’s Nancy Wang, who runs its cyber-applied AI work, says the service pairs round-the-clock scanning with agents that study the code, the app’s context and routes an intruder might take.
Reports from outside sources are fair game too, whether they come from a scanner, a bug bounty hunter or a disclosure. Red Team probes each one, then trials the fixes put forward, so a patch is measured against the flaw it claims to remove.
Defense Factory picks up from there. Its agents are built on the company’s security-tuned models, GPT-6 Cyber among them, and they confirm a suspected flaw inside a codebase, then write the repair. The output, Wang says, is a finished pull request that can be merged as it stands, with a test attached to show the repair works.
Nothing ships on its own. A person reviews and signs off before any change reaches production, and Defense Factory only prepares the change. OpenAI showed both tools at its Cyber at the Frontier event and describes them as meant for vetted defenders, inside the workflows security and development teams already use.
The announcement fits a run of security moves from the company, which also brought in Hacktron to hunt for flaws in its own systems last week. No price has been published for either tool, and Red Team’s early-access label means few teams can try it yet.
