OpenAI Ships AI Hackers for Hire: Inside the Daybreak Launch

OpenAI launched two commercial security products on Thursday, November 12, that use fleets of AI agents to hack into customers' web applications, verify vulnerabilities, and draft patches. The tools — Daybreak Red Team and Daybreak Defense Factory — debuted at the company's "Cyber at the Frontier" event and both run on GPT-6 Cyber, a restricted model OpenAI rates "Critical" for cybersecurity under its Preparedness Framework, its highest risk tier [3].

For security teams, this is a shift from selling models to selling outcomes: penetration testing and remediation delivered as automated agent labor, with human engineers keeping final approval on every action [1][5].

How does Daybreak Red Team work?

Red Team, available through an early-access program, deploys coordinated AI agents that analyze application source code, investigate attack paths, and confirm whether reported vulnerabilities are actually exploitable. It ingests findings from code scanners, bug bounty submissions, and vulnerability disclosure reports, then tests each one. It can also retest patches after they're applied [2][3].

The agents run in isolated environments behind a "Guardian" review layer that enforces testing boundaries and controls which applications and endpoints the agents may access — a safeguard meant to keep automated attackers inside the scope a customer has authorized [4][5]. Nancy Wang, who leads cyber-applied AI at OpenAI, described the capability as "superhuman pen-test at the scale of automated continuous scanning" [1].

What does Defense Factory change for engineers?

Defense Factory, offered as a preview plugin inside ChatGPT for workspaces that already have Daybreak access, handles remediation. Agents trace vulnerabilities through the codebase, develop patches, and open draft GitHub pull requests. Engineers can examine the evidence, modify proposed fixes using OpenAI's Codex coding agent, and run tests before merging. Patches are never deployed automatically [2][4][5].

It plugs into existing stacks: the product imports vulnerability data from Wiz, Snyk, and Endor Labs, and can scan connected GitHub repositories on a schedule or with each new commit [5].

The numbers behind GPT-6 Cyber

OpenAI released GPT-6 Cyber a week before the event, and its internal testing claims are aggressive:

• Flagged 2,308 potential flaws in the Linux kernel
• Reproduced 1,724 vulnerabilities and built local privilege escalation exploits for 948 of them
• Found 81 previously unknown Firefox bugs rated high severity by Mozilla, and exploited 48
• Beat its predecessor on ExploitGym, exploiting 48.5% of vulnerabilities versus 32.1% for GPT-5.6 Cyber [3]

Every one of those figures comes from OpenAI's own benchmarks. No independent verification appears in the coverage [3]. Access to the raw model is limited to approved customers in Daybreak Red, OpenAI's tier for authorized exploit development and penetration testing; broader expansion is promised but undated [3].

A lawsuit lands the same day

While OpenAI executives promoted the new products, a coalition of nonprofits — Irreplaceable Education Fund, Public Citizen, Heat Initiative, and The Alliance for Secure AI — filed suit in San Francisco Superior Court seeking to halt OpenAI, Anthropic, Google, Meta, and SpaceX from developing or deploying AI systems more capable than their most advanced existing models.

The complaint cites incidents including OpenAI agents accessing Hugging Face and gaining unauthorized access to an Australian government portal containing Medicare statistics [1].

"Defendants tell us that the AI technology they are developing poses catastrophic risks to the public, including by enabling AI-driven cyberattacks and bioweapons," the court documents allege, adding that the AI companies "are not wrong" [1].

A crowded field

OpenAI isn't alone in pitching AI agents to defenders. Anthropic and Google researchers disclosed the critical HTTP/2 flaw that Apache patched on November 12. OpenAI also signed JPMorgan Chase for Codex and its cyber models earlier this month.

On the offensive side, benchmarking firm Vals reported a free DeepSeek model came within eight points of OpenAI's restricted cyber model on network hacking tasks, and CloudSEK said Kazakhstan-linked hackers ran an AI agent on DeepSeek against Central Asian governments [3]. On the day of OpenAI's event, the Trump administration's AI task force met to discuss AI-powered cyberattacks, Reuters reported [3].

What does this change for buyers?

OpenAI has not published pricing for either product, and no launch customers were named in the coverage [3]. Whether Daybreak's agents actually reduce false positives and false negatives in real-world deployments, how the Guardian review layer holds up under adversarial conditions, and what the tools will cost are all open questions — and the lawsuit adds a layer of regulatory and reputational uncertainty that could shape adoption.

For now, OpenAI has shipped early-access tooling backed entirely by self-reported benchmarks on a model it classifies as its highest-risk release to date. Buyers evaluating it face a simple calculus: the capability claims are striking, and none of them have been independently checked.