# OpenAI turns a 250-person security code red into a "Defense Factory" > Source: > Published: 2026-09-09 23:10:16+00:00 # OpenAI turns a 250-person security code red into a "Defense Factory" **OpenAI says agents closed 53 urgent or high-priority issues on day one, then helped automate triage, validation and patching.** By [Ryan Merket](/author/ryan-merket) ยท Published Primary source: [OpenAI on X](https://x.com/OpenAI/status/2097786616311840853) ## Why it matters OpenAI is packaging its internal security process into an enterprise blueprint as it expands Daybreak access. The bet is that defenders can use frontier models faster than attackers adopt comparable tools. [OpenAI](https://openai.com/the-defense-factory/) has turned a 250-person internal security sprint into a reference architecture for continuously finding, validating and fixing software vulnerabilities with AI agents. OpenAI published the blueprint in early September and [promoted it again on September 9th](https://x.com/OpenAI/status/2097786616311840853), saying its latest cyber models uncovered vulnerabilities that its security staff might otherwise have missed. OpenAI called the project an internal "code red," bringing together its Security, Applied and Research groups to examine hundreds of systems across more than 100 service areas. The resulting "Defense Factory" connects AI agents to source-control platforms, security scanners, issue trackers and isolated development environments. Agents can inventory systems, scan code, test whether suspected vulnerabilities are exploitable, route confirmed findings to an owner, prepare patches and verify deployed fixes. Humans retain review authority over consequential changes and production deployments. OpenAI's pitch is continuous security work rather than periodic scanning. Findings trigger investigations automatically, suspected duplicates are merged, exploitability is tested in disposable environments and proposed fixes arrive with supporting evidence. The architecture uses a control plane for orchestration, policy enforcement and credentials, alongside a data plane where agents can reproduce problems without operating directly inside production systems. ### What OpenAI measured OpenAI says the sprint closed 53 urgent or high-priority issues on its first day. After OpenAI encoded service and ownership information for the agents, 90.6% of their ownership assignments were accepted. The process classified 37% of findings as duplicates, reproduced 19.5% of findings at runtime and reduced the false-positive rate after dynamic validation to 0.81%, according to OpenAI. Those figures measure the operation of OpenAI's workflow. They show how well the system routed, reproduced and filtered findings, rather than providing an independent assessment of the underlying models or the security condition of OpenAI's services. Patch generation was entirely Codex-based, OpenAI says. Agents received reproducible environments where they could recreate issues, test fixes and check whether patches disrupted normal application behavior. OpenAI reported a 0.53% rollback rate for fixes produced through the process. The human role shifted toward defining boundaries, reviewing ambiguous cases and checking results. OpenAI said it increased agent autonomy gradually, beginning with small batches and manual review before automating repeated steps. Early severity labels were too broad and changed depending on the instructions given to agents, forcing OpenAI to version its prompts and scoring rubric and add human spot checks. That detail matters because security agents can generate an expensive flood of plausible findings. A useful system must distinguish a reproducible vulnerability from a static warning, identify the responsible service owner and prove that the deployed fix actually worked. OpenAI's architecture treats those steps as one loop rather than separate security and engineering queues. ### Daybreak becomes an operating model The blueprint uses OpenAI's Codex products alongside two controlled cyber access levels. [Daybreak Blue](https://help.openai.com/en/articles/20001258-openai-daybreak-trusted-access-for-cyber-overview) runs on [GPT-5.6 Sol](/models/openai/gpt-5.6-sol) and is intended for defensive work such as secure code review, vulnerability triage, incident response and patch validation. Daybreak Red uses GPT-5.6 Cyber for approved penetration testing, exploit validation and other advanced security research, with additional verification and monitoring requirements. OpenAI's internal deployment also gives Daybreak a concrete enterprise architecture. Customers are being asked to connect models to sensitive code, vulnerability records, credentials and development environments. The Defense Factory lays out the controls OpenAI considers necessary: isolated workloads, credential proxies, policy enforcement, host monitoring, agent audit trails and human approval before production changes. The publication follows OpenAI's September 3rd announcement of [$1 billion in subsidized Daybreak access and support](https://openai.com/index/daybreak-for-frontline-defenders/) for organizations protecting essential services. OpenAI also said more than 35 partner products and managed services would carry Daybreak models into existing enterprise security workflows. OpenAI argues that defenders have a temporary advantage because they can give frontier models authorized access to private code and system context. Open-weight models available to attackers will continue improving, OpenAI says, allowing agents to retain knowledge across sessions, combine weaknesses into exploit chains and run in parallel. The Defense Factory is OpenAI's attempt to convert that capability gap into faster remediation before advanced cyber automation becomes broadly available. OpenAI is also using the internal sprint as proof that the approach can operate across a large, changing software estate. The stronger evidence will come from sustained production use: whether the low false-positive and rollback rates hold as agents receive more autonomy, cover more systems and confront vulnerabilities that require judgment beyond reproducible code changes.