OpenAI announced two new agentic products for cybersecurity — Daybreak Defense Factory and Daybreak Red Team. The tools are designed to automate vulnerability discovery, verify exploitability, and prepare fixes.
How the new AI agents work
The Daybreak Red Team is responsible for offensive validation (penetration testing). The agent conducts authenticated and unauthenticated web application checks, creates working proof-of-concept exploits, and after a patch is implemented, re-runs them to confirm the issue has been resolved without regressions, Cybernews reports.
Daybreak Defense Factory is engaged in code analysis and remediation. The tool collects vulnerability data from existing security scanners and from the Daybreak Red Team, sorts
All changes proposed by the agents must undergo review and approval by security specialists before deployment in the production environment (the human-in-the-loop principle). OpenAI President Greg Brockman noted that these solutions simplify the implementation of advanced AI for business protection.
New cyber model and benchmark results
Along with the products, the company presented a specialized cyber model not yet released for general access, which showed significant progress in internal tests:
OpenAI claims that the new model surpassed the performance of both GPT-6 Cyber and competing Claude models.
Access conditions and security measures
Due to dual-use risks (the possibility of using the tools for both defense and attacks), the products are currently available only to selected organizations upon prior application within the framework of the Daybreak trusted access program. Candidates must verify their identity and describe professional use scenarios in detail. OpenAI acknowledges that such restrictions do not guarantee the complete prevention of abuse, but they work in conjunction with other protection systems.
Experts also emphasize that security teams should treat patches generated by agents as unverified code: conduct thorough code reviews, run regression tests, and keep exploit testing environments isolated from production networks.