OpenAI launches two agentic security tools for offence and defence

OpenAI has announced two security products built on AI agents, SecurityWeek reported on 13 November 2026. One, called Daybreak Red Team, carries out penetration testing of web applications — that is, authorised simulated attacks intended to find exploitable weaknesses. The other, Defense Factory, investigates security findings and prepares patches for them.

According to SecurityWeek, the two tools cover opposite halves of the same workflow. Daybreak Red Team is the offensive side, probing a web application with agents rather than relying solely on human testers or conventional scanners. Defense Factory is the defensive side, taking security findings and working them up into fixes. Between them they describe a loop in which software is attacked, the results are triaged, and code changes are proposed.

The announcement is notable mainly because of who is making it. OpenAI is best known as a model provider, and its security work has until now been visible chiefly through the behaviour of its models rather than through standalone products aimed at security teams. Shipping named tools for red teaming and patch preparation puts the company in the same product category as established application security vendors.

It also puts AI agents on both sides of a security process that has traditionally been slow and manual. Penetration tests are typically scoped engagements that run for days or weeks and produce a written report. Triaging that report and writing fixes is separate work, often handled by a different team. Agentic tooling is pitched at compressing both.

SecurityWeek's report does not state pricing, availability, or which customers have access to the tools. Nor does it describe what guardrails govern the agents' behaviour during a test, how scope is enforced, or how patches produced by Defense Factory are reviewed before they reach production code. Those are the questions security teams will want answered before pointing an autonomous attacker at their own estate.

The risks in this class of tool are well understood in outline. An agent that can probe a live web application is, by design, doing things that would be hostile if aimed at the wrong target. An agent that writes patches is making changes to code that protects real users. Both depend on accurate scoping and on humans checking the output. OpenAI has not published detail on either point in the material covered by SecurityWeek's report.

For now, the announcement confirms a direction of travel rather than a finished picture. Agentic security tooling is moving from research demonstrations into named products from large model providers. How well these particular agents perform against real applications, and how much human oversight they need, will only become clear once teams outside OpenAI have run them.