As AI creates a cybersecurity minefield, OpenAI wants to give defenders a greater advantage.
On Thursday at the AI lab's "Cyber at the Frontier" keynote, OpenAI debuted two new cyber defense tools, aiming to expand access to frontier AI-powered cyber capabilities to a broader pool of defenders with turnkey, easy-to-implement solutions. The offerings add to the company's growing cybersecurity footprint, following the release of GPT-6 Cyber last week.
"The thing that needs to change is, as we're seeing this change in the physics of cybersecurity, this democratization of cybersecurity expertise, is that we need to build software in a fundamentally more secure way," OpenAI president Greg Brockman said in the keynote.
In a briefing with the press, Johannes Landgraf, head of cyber at OpenAI, said the "defender's window," previously described by Brockman as the ability to find and fix weaknesses ahead of attackers, is "under pressure" as more "broadly diffused models" become more widely available.
"Attackers are able to move faster. I think we see that right now almost on a daily basis," said Landgraf. "Defenders also have to move faster at that."
OpenAI unveiled two answers to this:
- Daybreak Red Team, a suite of security agents that can discover whether flaws in code can be exploited. One agent coordinates assessments, others investigate source code and application context, and finally reviewer agents check the results. This gives cyber teams the ability to prioritize which flaws to address first. Landgraf said that Red Team "paves the path for us to dramatically expand the access to our frontier cyber models over time."
- Daybreak Defense Factory, meanwhile, helps defenders "close the loop" on the exploits that Red Team digs up, said Landgraf. This release builds on Codex Security, which helps firms find and remediate code vulnerabilities, with agents that scan code as it changes, review pull requests and investigate alerts from tools. Upon finding a vulnerability, the agent reports what it found to the engineer responsible for the code, as well as proposes a patch in Codex.
The goal of these products is not to replace a conventional red team, Clint Gibler, who leads cybersecurity research at OpenAI, told the press. Rather, it's to help bridge the growing gap between what cyber defenders can protect and the sheer amount of code being generated by AI.
"There's always been a dearth of security expertise in the world," said Gibler. "There are many people building things, and now there's more people than ever, especially people without an engineering background. Our ability to secure the world needs to scale."
Additionally, because cyber defenders and expertise are stretched thin amid this changing landscape, it was a focus for OpenAI to make these products "turnkey and easy to use," Fouad Matin, cyber preparedness and safety lead at the lab, said in the briefing.
"As we look to more organizations who might not have the red team staff on hand, they might not have the same level of technical resources that some organizations do," said Matin.
Though OpenAI didn't offer any information on pricing for these products, Red Team is launching in early access with select customers and a waitlist open today, and Defense Factory is available through the Daybreak plugin in Codex.
Our Deeper View
It's commendable that OpenAI is actively creating tools to better arm a larger swathe of defenders as AI creates an increasingly complex cybersecurity landscape. However, security could represent more than just a way for OpenAI to help clean up the mess that, effectively, it helped create with its powerful frontier AI. Rather, it could represent a new revenue stream. These products, in addition to the release of GPT-6 Cyber, signal that OpenAI may be eyeing cyber as another path into the enterprise as it battles with rivals like Anthropic for high-value customers. And as these organizations scramble to secure themselves against AI-enabled attackers, many of which might not have strong cyber expertise, as Matin noted, the market is ripe for the taking.