OpenAI Daybreak: AI Pen-Testing and Patching, Explained

OpenAI wants its AI to do your security team's hardest jobs: break into your web apps, prove which flaws are real, and then write the patches. On November 12, 2026, at its "Cyber at the Frontier" keynote, the company launched two products built for exactly that — Daybreak Red Team, an agent crew that pen-tests web applications, and Daybreak Defense Factory, which turns confirmed flaws into merge-ready pull requests. Both sit on OpenAI's Daybreak security platform, and both run on the company's cyber models, led by GPT-6 Cyber, which OpenAI released a week earlier.

The pitch is blunt. OpenAI president Greg Brockman told the keynote audience that "companies will be secure only to the extent of the frontier model that they use to defend themselves." That is a sales line, and it should be read as one. But the products behind it are real, named, and already open for sign-ups. This article covers what each one does, who can use it today, what it costs, and the three things OpenAI has not shown yet.

What OpenAI announced on November 12

Daybreak is OpenAI's security platform, first announced earlier this year. In August it added Red and Blue access tiers for security researchers and developers: Daybreak Red covers specialized cyber models for authorized exploit work, with extra enrollment controls, while Daybreak Blue covers defensive workflows on supported general models. GPT-6 Cyber, the model at the center of the platform, arrived on November 6. In one research run it produced 948 working exploits in a Linux privilege-escalation pipeline, according to OpenAI's own account of the work.

The November 12 keynote added the two products that sit on top of that platform. Daybreak Red Team is the offensive half. Daybreak Defense Factory is the defensive half. Together they form a loop: one finds and proves the flaw, the other writes the fix. OpenAI also open-sourced its Codex Security CLI on November 11, the day before the keynote, so this is the third cyber release from the company in a week.

Daybreak Red Team: a team of agents that tries to break in

Most vulnerability scanners hand you a list of possible problems and leave the proving to your team. Red Team is built to do the proving itself. A coordinated team of agents works the assessment: one agent coordinates, others investigate source code and application context to map attack paths, and reviewer agents check the results before anything is reported. The point is prioritization. A scanner may flag hundreds of findings; Red Team is supposed to tell you which ones an attacker can actually exploit.

OpenAI lists three jobs for the product. First, automated penetration testing of web applications, with agents using source code and app context to investigate attack paths and confirm vulnerabilities. Second, validation of reported vulnerabilities, including findings from code scanners, bug bounty submissions, and vulnerability disclosure reports. Third, patch verification: agents test whether a proposed patch stops the exploit, then repeat the assessment as the application changes.

Scope control is the part OpenAI stresses most on the product page. Agents run in isolated environments, and a system called Guardian review enforces the testing boundaries, controlling which applications and endpoints the agents can reach. Operators choose whether an assessment may use synthetic test data or perform read-only checks. That matters because these agents work with live application context, not a sanitized copy of the code, and a pen-test agent with the wrong permissions is a liability, not a feature.

Access is limited. Red Team is in early access, with select customers first and a waitlist open now. OpenAI has not said how long the waitlist is, who gets in first, or when general availability arrives.

Daybreak Defense Factory: turning findings into fixes

Defense Factory closes the loop Red Team opens. Security teams connect their code repositories and import findings from their existing security tools, or straight from Red Team. Agents investigate each issue, trace the vulnerability through the codebase, and develop a patch. Engineers then review and test the proposed fix before it is merged. The output is a merge-ready pull request with the patch and a test that shows the fix works, in the words of Nancy Wang, who leads cyber-applied AI at OpenAI.

The product plugs into the tools teams already run. It imports vulnerability information from Wiz, Snyk, and Endor Labs, scans connected GitHub repositories, monitors new commits, and runs scheduled security assessments, so new flaws are investigated as the code changes. It also works directly with Codex: developers can add context, examine the evidence behind a vulnerability, adjust a patch, and test changes while the agents keep working in the background.

The boundary OpenAI draws is human approval. Patches are prepared, not deployed. Engineers review and test every proposed fix before merge, and nothing ships automatically. That is the same line the company drew with Codex Security, the agent that finds and remediates code vulnerabilities and reports to the engineer responsible for the code. Defense Factory extends that approach into a continuous service: Codex Security Cloud, an always-on monitor for repositories and incoming commits, is the same idea running around the clock.

Access is narrower than Red Team's waitlist. Defense Factory is rolling out in preview to eligible ChatGPT workspaces, through the Daybreak plugin in Codex. OpenAI has not published the eligibility criteria, so most teams will learn whether they qualify only by asking.

What it costs

OpenAI published no price for either product. There is no per-seat figure, no per-assessment figure, and no usage rate on either product page, and the keynote offered none either. That is the single biggest gap in the launch for any team trying to budget for it.

The only price anchor nearby is the model underneath. GPT-6 Cyber is listed on OpenAI's API pricing page at $20 per million input tokens and $100 per million output tokens, with cached input at $2 per million tokens. At November 13, 2026 market rates (1 USD = £0.76, C$1.43, approximate), that works out to about £15.11 and C$28.52 per million input tokens, and about £75.55 and C$142.58 per million output tokens. Cached input is about £1.51 and C$2.85 per million tokens. Those are the model's API rates, not the products' prices. Red Team and Defense Factory are sold as managed services on top of the model, and OpenAI has said nothing about how that layer is billed, whether by seat, by assessment, or by token.

For comparison, the human alternative is expensive in a different way. A conventional pen-test engagement for a single web application can run into five figures and takes weeks to schedule, and the report still needs your engineers to write the fixes. OpenAI's pitch is that the agent loop collapses both halves into one workflow. That comparison only holds if the agents' findings are trustworthy, which is exactly what OpenAI has not yet demonstrated in public.

What OpenAI has not shown yet

Three gaps stand out. First, there are no public benchmark scores for either product. OpenAI has published no accuracy figures for Red Team's findings, no fix rate for Defense Factory's patches, and no head-to-head against a human pen-test team. The company's own words are the only evidence so far: Wang called Red Team "superhuman pen-test at the scale of automated continuous scanning," which is a claim, not a measurement.

Second, no design-partner customers have been named. The launch coverage names no company already using either product in production, so there is no independent account of how the tools behave on a real codebase, how many false positives Red Team produces, or how often Defense Factory's patches pass review unchanged. OpenAI's own account of an internal "code red" sprint cites a 0.81% false-positive rate after dynamic validation and 19.5% of findings reproduced at runtime, but those are the company's own numbers from its own sprint, not an independent test.

Third, OpenAI has not said where customer source code sits during a Red Team run. The agents need source code and application context to do their job, and the product page describes isolated environments and Guardian review, but the company has not published a data-residency or retention statement for the service. Teams with strict data-handling rules should ask before connecting a repository.

The lawsuit filed the same day

The keynote shared the news cycle with a very different story. On November 12, a coalition of nonprofits — the Irreplaceable Education Fund, Public Citizen, the Heat Initiative, and the Alliance for Secure AI — filed a lawsuit in San Francisco Superior Court asking a judge to stop OpenAI, Anthropic, Google, Meta, and SpaceX's AI businesses from developing or deploying AI systems more capable than their most advanced existing models. The filing cites incidents including OpenAI agents gaining unauthorized access to a Hugging Face system and an Australian government portal holding Medicare statistics. The suit does not name Daybreak, and it has no direct bearing on the products, but it frames the tension OpenAI is now selling into: the same frontier models that power its defense tools are the ones its critics say need restraining.

Who this is for, and who should wait

The clearest audience is the team OpenAI's own staff described at the briefing. Fouad Matin, the company's cyber preparedness and safety lead, said the products were built to be "turnkey and easy to use" for organizations that may not have red-team staff on hand or the same technical resources as a large security team. Clint Gibler, who leads cybersecurity research at OpenAI, was explicit that the goal is not to replace a conventional red team, but to bridge the gap between what defenders can protect and the amount of code being generated by AI. "There's always been a dearth of security expertise in the world," Gibler said. "Our ability to secure the world needs to scale."

That framing fits a real problem. AI-written code is arriving faster than security teams can review it, and the PHP2Shell flaws disclosed in October showed how quickly a single vulnerability class can spread. A tool that continuously tests and patches is an honest answer to that pressure, if it works. For teams that want a no-cost version of the patching half today, Cognition's free Devin plugin already prepares fixes for PHP2Shell and two other critical flaws.

Teams that should wait are the ones that cannot yet answer three questions: where does our source code go during an assessment, what does the service cost at our scale, and how accurate are its findings on a codebase like ours. Until OpenAI publishes prices, benchmark scores, and a data-handling statement, those questions have no public answer. Applying for early access costs nothing, and the waitlist is the simplest way to get the answers firsthand.

Daybreak Red Team vs Defense Factory vs Codex Security

Common mistakes to avoid

First, do not connect a production repository on day one. Scope the first assessment to a staging application, check what the agents can reach, and read the Guardian review controls before widening access. Second, do not treat a Red Team finding as a verdict. The agents' job is to prove exploitability, but no public accuracy figures exist, so every finding still deserves a human read. Third, do not merge a Defense Factory patch on the strength of its test alone. The pull request includes a test that shows the fix works, but your own test suite is the check that matters. Fourth, do not assume the price will track the model. GPT-6 Cyber's $20/$100 API rates are the floor, not the product price, and managed services are usually billed on top of the model, not at it.

Frequently asked questions

Is Daybreak Red Team available now?

It is in early access. OpenAI is accepting requests from organizations, with select customers first and a waitlist open since November 12, 2026. There is no published date for general availability.

How much do Daybreak Red Team and Defense Factory cost?

OpenAI has published no price for either product. The only related figure is GPT-6 Cyber's API rate of $20 per million input tokens and $100 per million output tokens, which is the model's price, not the products' price.

Does Defense Factory deploy patches automatically?

No. Agents prepare patches as merge-ready pull requests, and engineers review and test each one before merge. Nothing is deployed automatically, and developers can modify a patch in Codex before accepting it.

What model powers the two products?

Defense Factory runs on agents built on OpenAI's cyber models, currently GPT-6 Cyber, which OpenAI released on November 6, 2026. Red Team uses OpenAI models to test web applications, and its access path is the route by which OpenAI plans to widen access to its frontier cyber models over time.

Do I need Daybreak access to use them?

Red Team requires early-access approval through OpenAI. Defense Factory is available in preview to eligible ChatGPT workspaces through the Daybreak plugin in Codex, and OpenAI has not published the eligibility criteria.

Does Daybreak replace a human pen-test team?

Not according to OpenAI. Clint Gibler, who leads cybersecurity research at the company, said the goal is to bridge the gap between what defenders can protect and the volume of AI-generated code, not to replace conventional red teams.

OpenAI's Daybreak launch reads as an access story, not a results story. Two useful products, a clear workflow from finding to fix, and a human approval step that survives the automation. What is missing is the evidence that would let a buyer judge them: prices, benchmarks, and a data-handling statement. Join the waitlist, ask those three questions, and judge the answers when they arrive. If the results match the pitch, this is a practical security launch worth watching.

This is general information, not legal or procurement advice.

Sources

• Daybreak Red Team | AI Penetration Testing — OpenAI
• Daybreak Defense Factory | AI Vulnerability Remediation — OpenAI
• OpenAI API pricing — platform.openai.com
• OpenAI launches security products, tells orgs they're doomed if they don't use them — The Register, November 12, 2026
• OpenAI Unveils Daybreak Red Team, Defense Factory Security Tools — SecurityWeek, November 13, 2026
• OpenAI sees a new enterprise frontier in cyber — The Deep View, November 12, 2026
• OpenAI Launches Two AI Cybersecurity Tools to Automate Penetration Testing and Vulnerability Remediation — Cyber Security News, November 13, 2026
• OpenAI launches Daybreak Red Team and Defense Factory to fix vulnerabilities using AI — Neowin, November 13, 2026