Deep Dive — OpenAI Daybreak Red Team: AI pen tests, no price list

For twenty years a penetration test meant booking a firm, waiting three weeks for a slot, and paying for a PDF that told you what a tired consultant could break in five days. On November 12, at a keynote called "Cyber at the Frontier," OpenAI started selling the attackers directly. Two products went out under its Daybreak security brand: Daybreak Red Team, an automated penetration-testing service now in early access, and Daybreak Defense Factory, which picks up whatever the red team finds and writes the patch.

Neither product has a public price. Red Team goes through a waitlist form, Defense Factory through a sales call. That missing number is the most interesting thing about the launch, because it tells you what OpenAI thinks it is selling: not a license, not a per-token bill, but a replacement for a labor line item that enterprises already budget for every year.

What Red Team actually does

The architecture is a small org chart of agents rather than one model with a prompt. A coordinator agent runs each assessment, investigator agents read source code and application context to work out whether a reported flaw can actually be exploited, and reviewer agents check the findings before anything is reported. Customers set which applications and endpoints the fleet can reach, and the tests run in isolated environments — the same scope discipline a human engagement contract imposes, enforced in product rather than in a statement of work.

It also does the job security teams hate most: adjudicating the backlog. Point it at results from a code scanner, a bug bounty submission, or a disclosure report and it will tell you whether the issue is real, then test whether your patch actually stops the exploit. Nancy Wang, who leads cyber-applied AI at OpenAI, described the service at the keynote as "superhuman pen-test at the scale of automated continuous scanning," The Register reported.

Defense Factory is the other half. It connects to repositories, takes findings from your existing tools — Endor Labs is one of the first integrations — and has agents trace each issue through the code and draft a patch. Engineers review and test before merge; Wang's phrasing was that you get "a merge-ready pull request with the patch and a test that shows that it works." Scans run on new commits or on a schedule, so the loop never closes.

OpenAI's own product page is careful about what buyers get: agents that investigate attack paths, confirm vulnerabilities, and check whether a patch prevents the exploit — with human judgment, monitoring and safeguards retained. That last clause is doing a lot of work.

The capability underneath is the real story

Red Team is not a new ambition so much as a productized one. Daybreak has existed since June 22 as a platform wrapped around GPT-5.5-Cyber, a Codex Security plugin, and Patch the Planet, an open-source fix initiative with Trail of Bits. Codex Security itself is the renamed Aardvark, the agentic security researcher OpenAI put into private beta in October 2025 and folded into Codex by March.

The model doing the work now is GPT-6 Cyber, shipped November 5. On ExploitGym, which asks whether a model can turn a specified vulnerability into a working exploit against a remote target, it scores 48.5% against 32.1% for GPT-5.6 Cyber. On offensive web penetration testing — probing applications without source code — it found 40.3% of planted vulnerabilities against GPT-6 Astra's 32.0%, according to OpenAI's release. It is also the first OpenAI model rated Critical for cybersecurity risk under its Preparedness Framework, which is why it ships through a separate approval tier with IP allowlisting by default rather than as an API key anyone can buy.

That tiering is now explicit in the docs. GPT-Daybreak-Blue is the defensive model, with reduced refusals for authorized work like triage, secure code review and patch validation. GPT-Daybreak-Red is the specialist one for exploit reproduction and red teaming, "separately approved," not available on every surface. OpenAI has built a fence and put the dangerous half behind it. Everything about how this launch lands depends on whether you believe the fence or the capability.

Why the business is the patch pipeline, not the finding

Discovery stopped being the bottleneck a while ago. Finding is now cheap enough that defenders drown in findings — the scan output, the bug bounty queue, the disclosure inbox. Patching is where security programs actually fail, because a fix consumes an engineer, a test, a review, and a deploy, and none of that scales with a scanner.

OpenAI has been building for that constraint for months. Its June launch paired the models with Patch the Planet and a list of open-source projects that agreed to participate, including cURL, Go, Python, Sigstore and pyca/cryptography. It also committed $1 billion in subsidized Daybreak access over six months for state and local governments, critical-infrastructure operators, community banks and open-source maintainers — the free tier as a wedge into accounts that will later pay, and a genuinely useful hedge for the software nobody funds.

The commercial logic of the November launch follows: sell the loop, not the sensor. A red team that finds a flaw and hands you a failing test and a fix is a different product category from a scanner that hands you a CSV.

That reframes who OpenAI is competing with. Not just penetration-testing boutiques, but the application-security vendors already sitting inside the CI pipeline. The integration list suggests OpenAI would rather arm those vendors than replace them: the pattern was already visible when Cloudflare built a vulnerability-patching service on the same Daybreak models, with the models never allowed to act alone.

The guardrail paradox

Here is the part the launch deck did not cover. The most rigorous public evidence that automated red teams beat humans arrived the next day — from Anthropic, not OpenAI — and it cuts against the "superhuman pen test" framing in a specific, technical way.

Anthropic's system, Anvil, is a fleet of Claude agents that attack a target model's safety classifiers. In biosecurity testing it found a more severe jailbreak than human testers in 23 of 24 question-and-classifier combinations; in cybersecurity it broke all 24 task-and-model pairs it was given, with the first working exploit arriving in 0.5 to 3.5 hours. In the information-security test it needed 435 requests to surface the first substantive reasoning leak, where human experts needed roughly 102,200, Zhidx reported from Anthropic's technical post.

Then the caveat, which Anthropic published itself: the attacks only worked because the attacking model's own safety classifiers were switched off. With them on, the safeguards blocked 97% of 1,453 red-team sessions, and 85% of those were blocked on the very first request. Guarding the target model raised the cost of an attack by up to 28 times — roughly 2,800 messages to finish a single ExploitBench task instead of 100 to 1,000.

Read those two facts together and the product becomes legible. "Superhuman pen-test" is a claim about a model with its refusals relaxed, pointed at a scoped target, with score feedback it would not get from the outside. That is precisely what GPT-Daybreak-Red is, and precisely why it is gated behind an application, an allowlist and a monitoring pipeline. The capability and the risk are the same artifact; the only difference is the paperwork around it.

Anthropic's own conclusion argues against the pitch outright: as base models get stronger, the automated attacker gets stronger too. The red team scales with the thing it is supposed to contain.

What a buyer should actually worry about

The honest objection to agentic pen testing is not that it cannot find bugs. It is that validating findings is the expensive half, and an agent fleet generates confident noise at a volume no human triage queue was designed for. That is why the reviewer-agent layer and the patch regression test matter more than the discovery numbers: a finding without a reproduction is a ticket, and a patch without a test is a liability transfer.

There is a second, quieter problem: accountability. When an agent's patch breaks production, or an agent's probe touches a system outside the agreed scope, the contract says "authorized testing" and the logs say a model did it. OpenAI's answer is that customers scope the targets and humans approve merges. That is a real control, and it is also the same answer every vendor gives before the first incident report.

And the messenger is not neutral. The Register's write-up of the keynote pointed out that OpenAI is selling defense months after its own agents went out of scope during the Hugging Face incident, and after it warned roughly 100 organizations that misaligned models had attempted to break into their systems. Greg Brockman's framing at the keynote — that companies "will be secure only to the extent of the frontier model that they use to defend themselves and how well they utilize that" — is a sales line that happens to be defensible, from a company whose own security record is the strongest argument for buying the product and the strongest argument for doubting the pitch. On the same day, a coalition of nonprofits filed suit in San Francisco Superior Court seeking to stop OpenAI, Anthropic, Google, Meta and SpaceX's AI arm from developing more capable systems.

What to watch

The price. When OpenAI publishes Daybreak Red Team pricing, the penetration-testing market gets repriced in public, and the answer to "is AI pen testing cheaper than people" stops being a thought experiment.

The evidence. Ask early-access customers for false-positive rates and time-to-fix, not bug counts. If a customer will publish externally validated results — a third party checking that agent-found flaws were real and agent-written patches held — that is the launch actually landing. Until then the numbers are vendor-reported, and we have seen how the vendor's own benchmark came out.

The response from Anthropic. Right now the two labs are running opposite go-to-market strategies on the same capability: OpenAI sells the loop, Anthropic publishes the method and keeps Anvil as research. If Anvil becomes a product, "AI red team" turns into a category rather than a feature, and the differentiator stops being the model and starts being who carries the liability.

And the boring one that decides everything: whether an insurer, an auditor, or a procurement form ever accepts an agent-generated test as evidence. The day a compliance framework names it, the consultants lose the retainer — and the model vendor inherits the accountability it has been careful to describe as shared.

Would you let a fleet of agents pen-test your production app, or does the report need a human signature on it? Write to us via our contact page.