OpenAI unveils Daybreak tools for continuous cyber defense

The opening speaker, introduced later as Greg, says AI is accelerating an existing cybersecurity struggle: attackers find and exploit vulnerabilities while defenders try to keep pace. He argues that limited security resources and accumulated technical debt require both repairing existing software and changing how new software is built.

Greg says OpenAI’s approach is to develop capable models, give trusted defenders access through Daybreak and help organizations use them. He calls the gap between frontier models and broadly available capabilities a “defender window,” while saying basic security practices still matter.

He describes a PHP vulnerability response under the funded Patch the Planet effort. According to Greg, a security researcher found the issue using a model and domain expertise; a later model independently found a more general version. OpenAI then coordinated with companies and governments on disclosure and patches.

Greg says roughly two months of coordination consumed substantial capacity across OpenAI, partners and governments. He considers scalable disclosure an open problem as discovery accelerates. He also mentions a company-announced $1 billion Daybreak defense fund for frontline defenders and critical infrastructure.

Nancy Wang, who leads cyber applied AI at OpenAI, introduces Daybreak Red Team and Daybreak Defense Factory. She says the products draw on internal work using frontier models to harden OpenAI’s own systems.

Wang says Red Team is launching in early access to test running applications from an attacker’s perspective. She presents its intended audience as defenders and organizations that may not have a dedicated red team.

Wang says Defense Factory scans code in reproducible cloud development environments, traces findings to code, suggests an owner and prepares a pull request with a patch and test. The company says the workflow can continue as new commits arrive.

A model presenter, introduced as Fouad, says GPT-6 Cyber was released the previous week and presents OpenAI’s ExploitGym benchmark, which tests proof-of-concept creation for supplied vulnerabilities. He reports a 52% score for GPT-6 Cyber and approximately 38% for a competitor in the company’s comparison.

He says OpenAI is developing another specialized model and reports that it scores nearly twice the competitor’s result on the stated benchmark. On PatchBench, which he describes as testing whether a model can find and fix a flaw without a regression, he reports around 80% for the upcoming model.

The presenter says stronger cyber agents must respect authorized scope and accurately report failures. He describes an evaluation that plants an easier, intentionally vulnerable target outside that scope to see whether the model uses it to complete its task.

For the evaluated cases, he reports GPT-6 Cyber stayed within scope 99.9% of the time without cyber safeguards and 100% with production safeguards. These are the company’s results for that evaluation. He also describes monitoring, checks on high-risk assistance and verified access as additional layers.

Clint Gibler, who leads cybersecurity research at OpenAI, says newer models can uncover issues in code that has already been tested. He also says apparently lower-severity bugs can become more serious when a model finds a new exploit path or chains several findings.

Gibler reports that a recent GPT-6 Cyber campaign found and reproduced 81 previously unknown high-severity Firefox vulnerabilities. He says the model also found new attack paths for 30 known issues previously considered lower severity and non-exploitable.

For the PHP issue, Gibler says the team used models to search for variants, test proposed patches for bypasses and assess mitigations for users unable to update immediately. He estimates that work took days with the models rather than weeks.

Gibler says OpenAI ran an automated discovery, exploitation and patching pipeline on Linux using GPT-5.6 Cyber and GPT-6 Cyber. He reports that one GPT-6 Cyber run validated and generated patches for almost 1,000 local privilege-escalation vulnerabilities, and found ten exploitation techniques new to his team and some outside parties it consulted.

Wang turns to the Red Team product demo. Alex, introduced by first name as a member of the product team, says a fleet of agents explores attack paths in a running application and helps reproduce and fix confirmed findings.

In a fictional collaborative-document application, Alex configures a staging-environment test focused on separation between customers. He says the campaign can use source code and connected context, with settings for duration, request rate, credentials and allowed traffic.

The campaign view shows findings and the endpoints being explored. Alex says the user can monitor progress and adjust the campaign if, for example, an endpoint or permission is missing.

He says agents work on separate tasks and coordinate through a shared queue and knowledge base. OpenAI describes infrastructure isolation, guardrails and a supervisor agent that monitors for deviations as parts of its layered safety design.

After advancing the demo, Alex opens a stored SQL-injection finding in which one fictional customer can access another’s document. The report presents the affected architecture, a chain of steps used to validate the finding and suggested starting points for a patch.

Wang says Red Team can also help validate existing findings and verify fixes, and that its results can be passed into Defense Factory. She frames the intended workflow as fixing backlogs as well as finding new vulnerabilities.

Matt, introduced as the leader of cyber product engineering, describes Defense Factory as a continuous defensive workflow. He identifies validation, deduplication, reproducible environments and integration with existing systems as practical challenges.

Wang says the product supports its own scanner and can import findings from third-party tools as well as Red Team. The demonstration shows an organization-level view that groups results by severity and consolidates duplicate reports.

Matt selects findings and shows how the product suggests a responsible code owner using signals from connected tools. A user can start fixes in the background or open a finding in Codex and guide the work interactively.

The presenters say cloud development environments let agents pull code and dependencies, reproduce a finding and test a proposed fix before a pull request is raised. They position this as support for existing human code-review and shipping workflows.

Matt shows options for continuous monitoring, scheduled scans and reviewing new commits. He says teams can configure checks to block pull requests when new code introduces critical issues, and run deeper scans on a schedule.

Wang recaps the company’s claims: agents can find and fix issues continuously, cloud environments can help validate findings, and the workflow integrates with Codex. She says Daybreak Defense Factory is available that day and asks users for feedback.

Wang cites a customer example from Intuit: she says its Night Falcon system maps repositories and data flows, tests findings and gives engineers evidence and tickets. According to her presentation, 87% of closed findings were confirmed vulnerabilities that were fixed; the rest were assessed as invalid.

She says Block uses Daybreak models in detection engineering and alert triage, reporting that a detection change can be tested against seven months of telemetry in under an hour and that the workflow saves 600 analyst hours per quarter on false-positive triage.

Wang also cites Sophos, saying agents resolve 52% of its managed detection and response cases end to end and that average response time fell from 38 minutes to 89 seconds. These figures are presented as customer examples, not general performance guarantees.

Wang closes with the Daybreak platform’s CLI and SDK, support from cyber deployment engineers and service partners, and plans to offer models through cloud partners. She invites feedback as the company expands access.