OpenAI launches Daybreak Red Team and Defense Factory to find and fix software flaws

OpenAI unveiled two new cybersecurity tools, Daybreak Red Team and Daybreak Defense Factory, on Thursday, 12 November. The first hunts for weaknesses in web applications and the second helps fix them. Both run on agents, AI programs that carry out a series of steps on their own.

An attacker's view of your own app

Red Team is being offered through an early-access programme. A group of agents studies an application's source code and context, looks for possible attack paths and checks whether a vulnerability really exists. It can also verify reports from code scanners, bug bounty programmes and security researchers, so teams know what to fix first. Once a patch is ready, Red Team tests whether it actually stops the exploit.

OpenAI said the tests run within set limits, in an isolated environment, with a separate control system deciding which applications and addresses the agents may reach.

A fix delivered as a pull request

Defense Factory handles the repairs. Its agents examine findings from existing security tools or from Red Team, trace the flaw through the code and prepare a fix. Engineers review and test the changes before they go into production. “This way engineers get a merge-ready pull request with the patch and a test that shows that it works,” Nancy Wang, who leads OpenAI's applied cyber work, told the conference, The Register reported.

The tool connects to a GitHub repository and can scan the whole default branch or selected folders, watch new commits and review pull requests before they are merged, Help Net Security reported.

Brockman: security depends on the model

“We're now at a point where companies will be secure only to the extent of the frontier model that they use to defend themselves and how well they utilise that,” OpenAI president Greg Brockman said at Thursday's conference. He added that security fundamentals still matter.

OpenAI first unveiled the Daybreak security platform in May. It competes with similar cybersecurity tools from other major AI developers.