OpenAI unveils AI agents that probe and patch software

Companies that want an AI to attack their own applications, hunt for weaknesses and then hand back a nearly finished fix now have somewhere to ask. OpenAI on Thursday introduced Daybreak Red Team and Daybreak Defense Factory, two cybersecurity products built on agents: AI programs that carry out tasks on their own, step by step.

Neither is something a customer can buy off a web page. Red Team has an early-access list where companies register interest, and Defense Factory, in a research preview, sends inquiries to sales. OpenAI has not published prices or said whether either will be offered in Mexico.

What each one does

Red Team plays the part of a penetration-testing crew, the authorized attackers companies hire to find holes in their own systems. The agents start from an application's source code and context, OpenAI says, and use them to work out attack paths and confirm which vulnerabilities are real. The company also pitches it for double-checking what code scanners or bug bounty programs flag, and for confirming that a patch actually stops the flaw. To keep tests inside their scope, it runs the agents in isolated environments and puts them under a review step called Guardian.

Defense Factory picks up from there. It takes alerts from a customer's existing security tools, or from Red Team, analyzes each problem and drafts a proposed patch. Engineers review and test it before it is merged; the system deploys nothing on its own. It can scan new code or run reviews on a schedule. The developer blog says it works as a plugin, has to be linked to a GitHub repository and needs a cloud Codex environment.

What hasn't been tested

Everything above is OpenAI's own description of its products. No independent evaluation of either one exists, and there are no figures on how many vulnerabilities they find or how many of their patches hold up.

Daybreak was already a program at the company; the two products are what is new. The blog adds that the offensive variant, which it calls Daybreak Red, requires separate approval and safeguards.

For people who use the affected apps, any benefit would come secondhand, if the companies that adopt these tools fix their flaws sooner.