OpenAI has launched two security products under its Daybreak brand, assigning AI agents tasks on both sides of application security. Daybreak Red Team looks for weaknesses in web applications; Daybreak Defense Factory scans code and prepares potential repairs.
One product searches for attack paths
Daybreak Red Team is available in Early Access. It uses AI agents to examine source code and app context, then map out attack paths that could expose vulnerabilities in web applications.
The product also checks security findings reported by bug bounty programs or code scanners. It can test patches as well, extending its role beyond finding a possible flaw to checking proposed fixes.
Nancy Wang, head of Cyber-Applied AI, said the aim is to provide penetration testing at the speed of automated continuous scanning while matching the depth of human testers. That describes the intended combination: frequent automated checks paired with investigation that can trace how weaknesses might be reached.
The other prepares defensive fixes
Daybreak Defense Factory focuses on what happens after vulnerabilities are identified. Its AI agents scan a company’s codebase and generate patches for potential problems.
The product packages its proposed fix as a ready-to-deploy pull request, with accompanying tests. Developers must approve the changes, so the generated patch is presented for review rather than applied without their approval.
That handoff links the automated scan to a practical next step. Instead of only reporting a vulnerability, the system can prepare a change and tests that developers can assess together.
A paired approach to security work
The two products address different stages of the same general process. Red Team investigates applications for weaknesses and tests patches; Defense Factory searches code and drafts patches with tests for developer approval.
For security teams, that pairing could make both discovery and remediation more continuous. A vulnerability finding can prompt a fix, while testing can help assess whether a proposed patch addresses the reported issue. The source describes these capabilities, but does not report results from deployments or quantify how well the products perform.
Both products run on OpenAI’s latest cyber model, GPT-6 Cyber. The model is the shared foundation described for the two tools, while the products apply it to distinct tasks: probing applications and preparing defensive code changes.
What the launch establishes
The launch puts OpenAI into the cybersecurity market with tools designed for both offensive-style testing and defensive code maintenance. The available information emphasizes automated agents, source-code analysis, app context, patch generation and developer review.
Daybreak Red Team’s Early Access availability is the only access status specified. The source does not provide pricing, broader release timing, customer names, performance measurements or details about how organizations can evaluate the products. For now, the announced distinction is clear: one product seeks and verifies weaknesses, while the other prepares fixes for developers to approve.