The Library Media — Science, Technology & Health · AI News & Intelligence Desk
Attack, Patch, Invoice: OpenAI Sells Both Sides of the Breach
By Gideon Black
Photo: Wikideas1 / Wikimedia Commons (CC0)
There is a neatness to OpenAI’s new cybersecurity proposition that should make investors smile and skeptics reach for a pencil.
According to OpenAI’s announcements at its Cyber at the Frontier keynote on November 12, the company has introduced two products on its Daybreak platform: one to investigate how software might be attacked, and another to help trace and repair the vulnerabilities found.
Daybreak Red Team attacks.
Daybreak Defense Factory helps patch.
And, according to OpenAI’s published billing mechanism, the scanning that makes this possible consumes tokens charged at plan rates, outside a plan’s included allowance.
Attack, patch, invoice.
That description is deliberately sharp, but not unfair to the structure OpenAI has announced. The more interesting question is whether this is the natural architecture of AI-powered security—or an unusually elegant form of enterprise lock-in.
President Greg Brockman supplied the thesis at the keynote. As quoted by The Register, he said companies will be secure only to the extent of the frontier model they use to defend themselves.
Perhaps.
Or perhaps that sentence is the commercial argument in its most concentrated form: security is becoming a subscription to the frontier capability of the vendor that defines the frontier.
The facts available so far do not settle the question.
They do establish how much OpenAI is asking customers to take on trust.
The attacker and the mechanic
According to OpenAI’s November 12 product material, Daybreak Red Team is a coordinated team of agents intended to investigate attack paths using source code and application context, then confirm vulnerabilities.
OpenAI says the system can validate findings originating from code scanners, bug bounties and disclosure reports, and can retest whether patches actually stop the exploit.
That last function matters.
A security finding is one thing. Establishing that a proposed repair actually closes the route used to exploit it is another. OpenAI’s announced architecture places Red Team on both sides of that loop: investigate the weakness, then retest the fix.
Operators, according to OpenAI, define which applications and endpoints the agents may reach. Testing runs in isolated environments with Guardian review. Access is currently available by early-access request.
Nancy Wang, who leads cyber applied AI at OpenAI, described the product as a “superhuman pen-test at the scale of automated continuous scanning.” That is OpenAI’s characterization, and it should remain precisely that.
There is, at present, no published product-level performance evidence that allows an outside observer to translate the phrase “superhuman” into a measurable claim.
No accuracy rate.
No detection rate.
No false-positive rate.
No published customer results.
No independently reported measure of how often a claimed vulnerability proves real, how often the system misses one, or how reliably its retesting establishes that a patch has closed an exploit.
Those omissions are the load-bearing fact of this launch.
A product can be genuinely useful before those numbers are published. But a skeptic should not fill in the missing measurements with adjectives supplied by the vendor.
The repair shop is automated—until the last human says yes
According to OpenAI, Daybreak Defense Factory is currently a research preview delivered as a ChatGPT plugin for web and desktop.
Its operational requirements are specific: a workspace with Daybreak access, a personal GitHub connection and a Codex cloud environment.
According to OpenAI’s product description, Defense Factory can perform a one-off repository scan, continuously monitor new commits or run on a schedule. It traces each identified vulnerability through the code and prepares patches for engineers to review.
The crucial safeguard is also clear in OpenAI’s description: patches are never applied automatically.
They can be refined with Codex and opened as GitHub draft pull requests, but an engineer reviews them before anything merges.
That restraint deserves more credit than it may receive amid the excitement about agentic cybersecurity. OpenAI is not, on the facts announced here, selling a system that autonomously rewrites production code and pushes its own fixes live.
It is selling a system that proposes the work.
Humans retain the merge decision.
Defense Factory can also import findings from Snyk, Endor Labs and Wiz. And, according to OpenAI, findings from Daybreak Red Team can feed directly into Defense Factory.
Here the closed loop becomes commercially and technically interesting.
One OpenAI product can generate or validate a security finding.
Another OpenAI product can trace that finding through a repository and prepare a patch.
The customer supplies the code, access and engineering judgment.
OpenAI supplies the model-powered machinery in between.
That may be an efficient security workflow.
It may also create an incentive to consolidate more of the workflow around OpenAI’s infrastructure.
The distinction depends on whether the integrated system produces results good enough to justify the concentration.
And on that question, OpenAI has not yet published the numbers.
The model underneath is powerful enough to be a problem
According to The Register, Defense Factory’s agents currently run on GPT-6 Cyber, the cybersecurity-focused model OpenAI introduced on November 5 for approved Daybreak Red customers.
OpenAI rated GPT-6 Cyber Critical for cybersecurity under its Preparedness Framework—the first OpenAI model to receive that level, according to the facts available here.
This is where the commercial structure becomes unusually revealing.
OpenAI is using a model it has characterized as requiring its highest cybersecurity preparedness level to power products intended to investigate vulnerabilities and help repair them.
The model’s restricted character is therefore not merely a safety constraint.
It is also part of the product.
That does not make the restriction a marketing strategy. A model can be dangerous enough to warrant controlled access and commercially valuable enough to support a premium service at the same time.
Both propositions can be true.
But customers should understand what follows from them.
If Brockman’s formulation is correct—that a company’s security is capped by the frontier model it uses for defence—then frontier-model access becomes an essential security input.
And if that frontier access is concentrated in a vendor’s controlled platform, then the vendor does not merely sell software. It increasingly mediates the ceiling of what the customer can do.
That is a powerful business position.
It may also be an accurate description of where cybersecurity is going.
The facts do not yet tell us which interpretation deserves more weight.
The one number we have is not a product result
OpenAI has published no accuracy, detection-rate, false-positive or patch-quality figures for either Daybreak Red Team or Defense Factory.
That point should not be buried beneath the launch language.
The only verifiable model performance numbers in the record provided here remain from OpenAI’s November 5 GPT-6 Cyber system card: a vendor-reported 48.45% intended-exploit success rate on ExploitGym, compared with 42.43% for GPT-6 Astra.
Those are model-level benchmark figures.
They are not performance results for Daybreak Red Team.
They are not vulnerability-detection rates for Defense Factory.
They are not patch-success rates.
They do not tell us how frequently a customer will receive a useful finding, a false alarm or a patch that requires substantial correction.
And the absence of product-level numbers is not repaired by pointing to the model benchmark.
This distinction is precisely the kind of detail that disappears in a launch cycle. A company demonstrates a capable underlying model; observers infer that the product built on top of it must therefore be accurate; the inference becomes a reputation; the reputation becomes a buying decision.
That chain contains several steps too many.
A powerful model is not the same thing as a measured product.
Follow the billing
OpenAI’s billing mechanism adds another reason to separate capability claims from commercial incentives.
According to OpenAI, cloud scans are charged by token usage at plan rates and are not covered by the plan’s included allowance. A workspace shares one balance, and free scanning credits do not expire.
OpenAI has published no product pricing beyond that mechanism.
There is nothing improper about usage-based billing. If large-scale AI-driven security analysis consumes model inference, charging for consumption is an intelligible commercial model.
But the incentives deserve inspection.
The system that investigates the vulnerability consumes usage.
The system that traces it through the code consumes usage.
The system that helps prepare the patch operates inside the same broader AI environment.
The economic question is not whether charging for this work is legitimate. It plainly can be.
The question is whether customers will be able to distinguish valuable security work from expensive AI activity with sufficient clarity to make informed decisions.
Without product-level detection, false-positive and patch-quality data, the customer is being asked to evaluate both the quality of the output and the value of the consumption largely through its own experience.
That may work well for sophisticated buyers.
It is not the same thing as transparent evidence that the product performs at the level implied by the marketing.
Is Brockman describing defence—or dependency?
Brockman’s keynote line, as quoted by The Register, is worth taking seriously because it may be true.
If attackers gain access to increasingly capable frontier models, defenders may indeed need comparably capable systems to investigate complex attack paths and keep pace.
Security has always involved an arms race.
AI may simply make the quality of one’s computational tools more important.
But the sentence has another reading.
If your security is only as good as the frontier model you rent, then your security ceiling increasingly belongs to whoever operates the frontier model.
That is not merely a security philosophy.
It is an enterprise business model.
The customer can connect its repositories. The platform can scan them. The agents can investigate them. Findings can move from Red Team to Defense Factory. Patches can be drafted and refined through Codex. Usage is billed by tokens.
The integration may be excellent.
It may also make leaving more difficult.
Again: those possibilities are not accusations. Integration creates value. That is why companies build integrated products.
The skeptic’s question is what happens when the value of integration and the cost of dependency begin to point in opposite directions.
OpenAI has launched the system. It has not yet supplied enough public product evidence to answer that question.
What should a careful buyer demand?
Not rhetoric about “superhuman” performance.
Measurements.
OpenAI should eventually be able to show how often Red Team identifies real vulnerabilities, how often it produces false positives, and how its performance compares across defined tasks.
Defense Factory should eventually be judged on the quality of the patches it prepares: how often they address the identified vulnerability, how much engineer revision they require and how reliably the fixes hold up under retesting.
Customer results would help, when available.
Until then, the product architecture is more impressive than the public evidence for its effectiveness.
That does not make the products failures.
It means the launch is ahead of the scorecard.
One line of context is worth noting: the products launched on the same day OpenAI was sued by nonprofits seeking to halt frontier development.
And one distinction should be preserved from this desk’s earlier coverage: OpenAI’s internal Control Room is a different system from these Daybreak products.
The larger point remains.
OpenAI now offers customers a platform that can investigate vulnerabilities, move those findings into a system that prepares repairs, and charge for the model consumption involved.
The underlying cybersecurity model is, according to OpenAI’s own framework, its first rated Critical for cybersecurity.
That combination could represent a significant advance in defensive capability.
Or it could become a particularly refined form of dependency in which the frontier model is simultaneously the tool customers need, the service they rent and the meter that bills them.
The evidence published so far does not permit a verdict.
But it permits a question.
And, for the moment, the question is doing more work than the numbers.
Gideon Black
Chief Skeptic, The Library Media
From The Library — the estate of our family.
