OpenAI Launches Two AI Cybersecurity Tools to Automate Penetration Testing and Vulnerability Remediation - CyberSecurityNews
OpenAI has introduced two AI cybersecurity tools, Daybreak Red Team and Daybreak Defense Factory, to automate penetration testing and vulnerability remediation.
Announced on November 12, 2026, the products form part of OpenAI's Cyber at the Frontier event. They target a common security challenge where finding potential weaknesses is only the first step. Teams must determine if attackers can exploit these flaws, understand their impact, and verify that proposed patches actually eliminate the risk.
Automated Testing and Validation
Daybreak Red Team, now available in early access, uses OpenAI models to examine web applications for vulnerabilities. The tool combines continuous scanning with agents that investigate source code, application context, and possible attack paths. Rather than stopping at scanner warnings, it tests whether reported issues present real security risks.
A service that combines continuous scanning with agents that investigate source code, application context, and possible attack paths.
Automated Remediation
Daybreak Defense Factory focuses on finding, validating, and fixing vulnerabilities across codebases. Its agents use OpenAI's cyber models, including GPT-6 Cyber, to investigate potential flaws and develop proposed patches. Engineers review and approve these changes before they enter production.
According to Wang, engineers receive a merge-ready pull request containing the patch and a test showing that the fix works. This provides both a suggested repair and evidence they can assess during code review, making the output more useful than standalone alerts.
Broader Security Approach
The announcement extends OpenAI's earlier work on Codex Security, which builds project-specific security context and generates patches. It also builds on Codex Security Cloud, an always-on service that monitors repositories and incoming commits, investigating potential vulnerabilities and preparing fixes.
Human approval remains a clear boundary in the new launch. Defense Factory prepares changes rather than deploying them independently, and Red Team's early-access status limits immediate availability. OpenAI is positioning these products to complete the security workflow, not simply increase the number of vulnerabilities reported.
Related
