OpenAI has launched two cybersecurity products — Daybreak Red Team, an agent system that penetration-tests your web applications, and Daybreak Defense Factory, which finds vulnerabilities in your codebase and drafts the patches. Unveiled November 12 at the company’s “Cyber at the Frontier” keynote, they turn OpenAI’s vetted-only GPT-6 Cyber model into tools ordinary security teams can actually buy into.
November 13, 2026
What the two products do
Daybreak Red Team, available in early access with a waitlist, runs a fleet of agents against a company’s web applications: one agent coordinates the assessment, others investigate attack paths using source code and application context, and reviewer agents check the results. OpenAI’s Nancy Wang, who leads cyber-applied AI, described it as superhuman penetration testing at the scale of automated continuous scanning. It also validates vulnerabilities reported by code scanners, bug bounty programs and disclosure reports, then tests whether patches actually fix them.
Daybreak Defense Factory works the other side of the loop. Its agents — built on OpenAI’s latest cyber models, currently GPT-6 Cyber — scan codebases, hunt for vulnerabilities and develop patches. Engineers review and approve every fix before it ships; Wang said the output is a merge-ready pull request with the patch and a test showing it works. Defense Factory is available through the Daybreak plugin in Codex, and builds on the earlier Codex Security tooling. OpenAI announced no pricing for either product.
The pitch: defense has to match the model’s speed
OpenAI President Greg Brockman argued in the keynote that companies will be secure only to the extent of the frontier model they use to defend themselves and how well they use it. Head of cyber Johannes Landgraf told press the “defender’s window” — the head start defenders get to find and fix weaknesses before attackers exploit them — is under pressure as capable models spread. The products are explicitly not meant to replace human red teams, OpenAI’s Clint Gibler said, but to close the gap between a shortage of security experts and the flood of new code — much of it now AI-generated — that needs securing. The launch came the same day a coalition of nonprofits sued OpenAI and other labs seeking to halt frontier AI development, citing AI-driven cyberattacks among their concerns.
Why it matters
Until now, OpenAI’s strongest cyber model was gated: GPT-6 Cyber, released November 5, went only to vetted security customers. Daybreak is how that capability becomes a product line — and a new enterprise revenue front against Anthropic, which has been expanding its own cyber verification program. For smaller teams with no red-team staff, a turnkey agent that both attacks and patches is a genuinely new option; the open questions are price, which OpenAI hasn’t given, and how much human review the “merge-ready” patches really need in practice. Everything AI, tested: we’ll be watching the early-access results before treating the superhuman claim as settled.
Frequently asked questions
What is OpenAI Daybreak Red Team?
An early-access product in OpenAI’s Daybreak security platform that uses a fleet of AI agents to continuously penetration-test web applications, investigate attack paths with source-code context, and validate reported vulnerabilities and their patches.
What is Daybreak Defense Factory?
An agent system that scans codebases for vulnerabilities and drafts fixes as merge-ready pull requests with tests. Engineers review and approve patches before anything reaches production. It is available through the Daybreak plugin in Codex.
How much do the Daybreak products cost?
OpenAI announced no pricing at launch. Red Team is early access with a waitlist; Defense Factory ships via Codex.
Sources: The Register, The Deep View, November 12, 2026.