OpenAI has introduced two new Daybreak cybersecurity products that use AI agents to test web applications for vulnerabilities and help security teams develop fixes.

The products, Daybreak Red Team and Daybreak Defense Factory, were announced at the company’s Cyber at the Frontier event on November 12. Red Team focuses on penetration testing and vulnerability validation, while Defense Factory investigates security findings and prepares patches.

Daybreak Red Team uses multiple AI agents to identify and investigate potential security weaknesses in web applications. “Agents use source code and app context to investigate attack paths and confirm vulnerabilities,” OpenAI says.

The product can examine findings from code scanners, bug bounty submissions, and vulnerability disclosure reports.

OpenAI says the agents operate in isolated environments, with Guardian review enforcing testing boundaries and controlling which applications and endpoints they can access.

Daybreak Defense Factory, meanwhile, is designed to help organizations address vulnerabilities identified by their security tools.

“Agents trace vulnerabilities through your code and develop patches. Engineers review and test proposed patches before merge,” OpenAI explains.

Defense Factory can investigate findings from Daybreak Red Team and other security products, and supports importing vulnerability information from Wiz, Snyk, and Endor Labs. The product can scan connected GitHub repositories, monitor new commits, and perform scheduled security assessments.

Engineers can examine supporting evidence, modify proposed patches using Codex, and create draft GitHub pull requests. However, patches are not deployed automatically.

OpenAI is accepting requests for early access to Daybreak Red Team. Defense Factory is offered through a preview plugin in ChatGPT for workspaces with Daybreak access.

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Join to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.

Cohere has appointed Jaya Baloo as CISO.

Jensen Huang has resigned as President and Chief Executive Officer at NVIDIA.

Sean Sweeney has become CIO of the City of Charleston, South Carolina.

Overreliance on AI could erode the creativity, clear communication, and critical thinking security teams need when there’s no playbook. (Joshua Goldfarb)

Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter. (Danelle Au)

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it. (Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you. (Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies. (Sravish Sridhar)