OpenAI has launched Daybreak, a two-product security suite that pairs AI-agent-driven penetration testing with automated vulnerability remediation for web applications1,2.
The suite comprises Daybreak Red Team, now available through an early-access program, and Daybreak Defense Factory. Red Team uses coordinated agents to examine application source code, investigate potential attack paths, and confirm vulnerabilities. It can validate findings from code scanners, bug bounty submissions, and vulnerability disclosure reports, giving security teams evidence to prioritize repairs. Once a patch is ready, Red Team can retest whether it blocks the exploit.
How Defense Factory closes the loop
Defense Factory handles remediation: agents investigate findings surfaced by existing security tools or by Red Team, trace vulnerabilities through the codebase, and prepare proposed fixes. The two products connect the work of finding security weaknesses with patching and retesting them.
Assessments run within defined boundaries, using isolated environments and a Guardian review layer to control which applications and endpoints agents can reach. OpenAI warned organizations about the broader threat landscape alongside the launch.
GitHub integration and scan modes
Teams with access can install and enable the Daybreak Defense Factory preview as a plugin in ChatGPT and connect a GitHub repository. Scans can cover an entire repository's default branch or selected folders and files. An optional Deep scan mode makes multiple passes, using additional time and tokens. The desktop app supports scans of local checkouts and uncommitted changes, and teams can monitor new commits on the default branch, schedule recurring scans, and enable security reviews of pull requests before changes merge. Each person starting a scan needs a personal GitHub connection, and cloud scans run in Codex cloud. Engineers review and test patches before merging them.
The launch extends OpenAI's recent push to build out its developer-tooling stack. The company announced the acquisition of Pierre Computer Company on November 12, bringing source control and code review capabilities into Codex to transform it from a coding assistant into a broader development platform[3].
ANALYSIS Daybreak positions OpenAI's agent infrastructure as a direct participant in the security workflow rather than a general-purpose assistant layered on top of it, bundling offense and defense into a single pipeline that competes with standalone application-security vendors.