OpenAI launches security products, tells orgs they’re doomed if they don’t use them

Meanwhile, a group of nonprofits sue AI giants and cite AI-driven cyberattacks

OpenAI has launched two new security products, one for penetration testing and another for defense, and warned organizations that their businesses are only safe if they use tools like these.

“We're now at a point where companies will be secure only to the extent of the frontier model that they use to defend themselves and how well they utilize that,” OpenAI President Greg Brockman said during a Thursday keynote address.

The co-founder of the company that broke security did admit that security “fundamentals are important, and not to be discounted.” 

REG AD

However, “you need to really reorient your security practice around what these models can do,” Brockman said, with zero irony, and presumably talking about using AI models for defense - not for hacking other organizations. “Also very important is product.”

REG AD

This product, of course, should come from OpenAI, and, to that end, the company rolled out Daybreak Red Team and Daybreak Defense Factory, which are both part of OpenAI’s Daybreak security platform. 

Red Team, which is available in early access, uses OpenAI models to test companies’ web applications for vulnerabilities. Nancy Wang, who leads cyber-applied AI, described it as “superhuman pen-test at the scale of automated continuous scanning,” with a fleet of agents using source code and app context to investigate and test attack paths. 

It also helps security teams validate reported vulnerabilities - from code scanners, bug bounty programs, and disclosure reports - and then test the patches for these flaws.

The second product, Daybreak Defense Factory, automates the “defensive loop” by “finding, validating, and fixing vulnerabilities at scale.” This one also uses agents built on OpenAI’s latest cyber models - currently, that’s GPT-6 Cyber. The agents scan organizations’ codebases, hunting for vulnerabilities and developing patches. Engineers review and approve the proposed fixes before they go into production.

“This way engineers get a merge-ready pull request with the patch and a test that shows that it works,” Wang said.

Meanwhile, as OpenAI execs touted the new security products, a coalition of nonprofits filed a lawsuit in San Francisco Superior Court asking a judge to stop OpenAI, Anthropic, Google, Meta, and SpaceX's AI businesses from developing or deploying AI systems more capable than their most advanced existing models.

The lawsuit, filed by Irreplaceable Education Fund, Public Citizen, Heat Initiative, and The Alliance for Secure AI, cites incidents involving OpenAI agents accessing Hugging Face, gaining unauthorized access to an Australian government portal containing Medicare statistics, and other AI-related cybersecurity incidents.

“Defendants tell us that the AI technology they are developing poses catastrophic risks to the public, including by enabling AI-driven cyberattacks and bioweapons,” the court documents allege, adding that the AI companies “are not wrong.” ®