Skip to content
Neural Daily

ToolsNews

OpenAI Daybreak Red Team: agent-run pentesting

🇭🇺 Olvasd el magyarul →

OpenAI launched two security products on its Daybreak platform. Red Team uses a team of agents to pentest web applications and confirm whether a flaw is exploitable. Defense Factory turns findings into review-ready patches.

· 2 min read

A Daybreak Red Team felirat korall színátmenetes háttéren, az OpenAI termékoldaláról
Image: OpenAI · Press kit · Source

What Red Team does

Daybreak Red Team puts a coordinated team of agents to work on your web applications: they use source code and app context to investigate attack paths, then confirm whether a vulnerability can actually be exploited (OpenAI).

  • It validates findings from elsewhere too: code scanners, bug bounty submissions and disclosure reports.
  • It tests whether a patch stops the exploit and can be rerun as the app changes.
  • Scope is enforced with isolated environments and Guardian review, and you control which apps and endpoints agents can reach.
  • It launches in early access with select customers and a waitlist.

And Defense Factory

Defense Factory focuses on fixing. You connect repositories and bring in findings from existing security tools or Red Team; agents trace each vulnerability through the code and develop a patch that engineers review and test before merge (OpenAI). You can add context and tune the fix in Codex, and schedule scans of new commits or recurring checks. It is in preview for eligible ChatGPT workspaces.

According to The Register, the agents run on OpenAI's latest cyber model, GPT-6 Cyber, released last week (The Register; GPT-6 Cyber: OpenAI's new cybersecurity model). No pricing was announced.

Why it matters

Traditional scanners flag possible weaknesses; Red Team tries to prove exploitability, which helps most with prioritization because real risk moves to the top of the backlog. Greg Brockman said companies will be secure only to the extent of the frontier model they use to defend themselves. That is a strong vendor claim. The practical question is how much access you are willing to give an external agent fleet to your source code and staging environments.

    By Mikola Máté Patrik

    Produced with the help of AI, reviewed by an editor. How we make our articles

    Reviewed and edited by the Neural Daily desk. About

    Related articles