OpenAI announces Daybreak tools for automated cybersecurity work

• OpenAI announced Daybreak Defense Factory for remediation and Daybreak Red Team for penetration testing in gdb's launch post.
• Repository scanning and web-app testing have separate workflows, described in the Defense Factory excerpt and the Red Team excerpt. Both connect vulnerability findings to fixes.
• The upcoming cyber model reached 77% on ExploitGym versus GPT-6 Cyber's 52.6%, a 24.4-point gain, according to WesRoth's report.

The launch's best detail sits in OpenAI's internal write-up: follow-up checks found gaps between merged patches and fixes deployed across the fleet. Red Team also uses isolated environments and Guardian review to control which applications and endpoints its agents can reach.

Engineers retain responsibility for reviewing and testing patches before merge in OpenAI's Defense Factory workflow. The product combines four capabilities:

• Investigation and patching: Agents trace vulnerabilities through code and prepare fixes.
• Imported findings: Existing security tools and Daybreak Red Team supply issues for agents to investigate.
• Codex collaboration: Engineers add context, inspect evidence, and tune patches while agents continue working in the background.
• Continuous scanning: New commits and scheduled recurring checks trigger further investigation as the code changes.

OpenAI presented the tools as automated patching and automated red teaming in its keynote announcement.

Daybreak Red Team coordinates multiple agents to test web applications. Agents use source code and application context to investigate attack paths, according to the product page.

Its workflow covers three jobs:

1. Discover vulnerabilities: Explore attack paths and confirm whether suspected weaknesses are exploitable.
2. Validate incoming reports: Test findings from code scanners, bug bounty submissions, and disclosure reports.
3. Retest fixes: Check whether a patch stops the exploit, then repeat assessments as the application changes.

ExploitGym tests whether a model can exploit a specified vulnerability in a remote target, according to OpenAI's benchmark description. The keynote plotted success against average output tokens, with an x-axis extending to 80,000 tokens.

The ExploitGym figures reported by WesRoth and the PatchBench figures reproduced in chetaslua's comparison chart give these deltas:

• ExploitGym versus GPT-6 Cyber: 52.6% → 77.0%, +24.4 percentage points.
• ExploitGym versus GPT-6 Astra: 42.4% → 77.0%, +34.6 percentage points.
• PatchBench versus GPT-6 Cyber: 73.5% → 79.1%, +5.6 percentage points.

Google's result was initially understated in scaling01's posts, which corrected Gemini 4 Carbon from an initial 30–50% range to roughly 54%. The rival scores in chetaslua's chart were:

• Gemini 4 Carbon: 54.8% on ExploitGym.
• Claude Mythos 5.2: 38.1%.
• Claude Opus 5.5: 33.3%.

That compilation combines vendor-reported figures from OpenAI's keynote, Google's launch post, and Anthropic results via BenchLM.

The keynote baseline also differs from the earlier model announcement: OpenAI's November 5 launch post reports 48.5% for GPT-6 Cyber. The 24.4-point improvement is specifically the comparison within the keynote chart, which labels the new system only “Upcoming Cyber Model.”

OpenAI's Daybreak access page separates permissions into two tracks:

• Daybreak Blue: Defensive work including vulnerability discovery, validation, remediation, threat modeling, and security investigation.
• Daybreak Red: Advanced authorized red teaming, penetration testing, exploit validation, and controlled security research.

Applicants can be individuals or organizations. OpenAI verifies applicants and reviews intended use before approving access.

The existing GPT-6 Cyber model initially became available through the API and Codex to selected approved Daybreak Red customers, according to its November 5 announcement. The newly previewed model was described as upcoming during the keynote.

Chat subscriptions are a separate access question. Responding to a subscriber, TheRealAdamG said the cyber model was “not part of a Chat sub.”

OpenAI said the tools grew out of vulnerabilities its models identified and helped resolve in its own code and infrastructure. Its internal Defense Factory account describes a security sprint involving more than 250 people and over 100 service areas.

The published defensive loop has five stages:

1. Inventory: Map systems, exposed endpoints, code, and owners.
2. Discovery: Scan and analyze code, then import existing vulnerability reports.
3. Dynamic validation: Reproduce suspected vulnerabilities and retain evidence.
4. Ownership assignment: Route validated findings to named owners.
5. Verified remediation: Prepare patches, deploy authorized changes, and verify the deployed fix.

Shared SECURITY.md files carry system context across these stages. Each pass contributes ownership information, investigation evidence, and established checks so subsequent runs can reuse prior work.

The architecture separates a control plane containing orchestration, policy enforcement, and a credential proxy from a data plane of isolated execution environments. Agent harnesses, skills, and applications run inside development containers, with environment identities and host monitoring.

Environment setup became a bottleneck during OpenAI's sprint. Missing dependencies and configuration differences forced the team to distinguish a vulnerability that failed to reproduce from a test that could not run correctly, according to the internal account.

OpenAI reports three operational results:

• 19.5% of findings were reproduced at runtime.
• 0.81% false-positive rate remained after dynamic validation.
• 0.53% of fixes were rolled back.

The published workflow requires reproduction evidence for a validated vulnerability; static code tracing alone does not qualify. Failed or inconclusive checks remain attached to the finding.

Execution environments are newly created for each run and discarded afterward, including their state. Patch tests check both whether the security flaw is fixed and whether normal application behavior still works.

OpenAI expanded deployed-fix verification after a small trial, but kept automatic issue reopening disabled while it worked out how to account for deployment delays.