MeridianMeridian

OpenAI Launches Daybreak Red Team and Daybreak Defense Factory AI Security Tools

OpenAI has introduced two new cybersecurity products, Daybreak Red Team and Daybreak Defense Factory, that leverage AI agents to identify vulnerabilities in web applications and assist with developing fixes. The announcement took place at the company’s Cyber at the Frontier event on November 12. Daybreak Red Team performs penetration testing and vulnerability validation by using multiple AI agents that analyze source code and application context to confirm attack paths. The agents operate in isolated environments with Guardian review enforcing access boundaries. Daybreak Defense Factory helps security teams investigate findings and generate patches, supporting data imports from tools such as Wiz, Snyk, and Endor Labs. It can scan GitHub repositories, monitor commits, and allow engineers to review and modify proposed patches using Codex before creating draft pull requests. Neither product deploys patches automatically, and early access requests are now being accepted for Daybreak Red Team.

SecurityWeekTranslated from English

Read at source

OpenAI has introduced two new Daybreak cybersecurity products that use AI agents to test web applications for vulnerabilities and help security teams develop fixes. The products, Daybreak Red Team and Daybreak Defense Factory, were announced at the company’s Cyber at the Frontier event on November 12.

Daybreak Red Team focuses on penetration testing and vulnerability validation, while Defense Factory investigates security findings and prepares patches. Daybreak Red Team uses multiple AI agents to identify and investigate potential security weaknesses in web applications. “Agents use source code and app context to investigate attack paths and confirm vulnerabilities,” OpenAI says. The product can examine findings from code scanners, bug bounty submissions, and vulnerability disclosure reports.

OpenAI says the agents operate in isolated environments, with Guardian review enforcing testing boundaries and controlling which applications and endpoints they can access. Daybreak Defense Factory, meanwhile, is designed to help organizations address vulnerabilities identified by their security tools. “Agents trace vulnerabilities through your code and develop patches. Engineers review and test proposed patches before merge,” OpenAI explains.

Defense Factory can investigate findings from Daybreak Red Team and other security products, and supports importing vulnerability information from Wiz, Snyk, and Endor Labs. The product can scan connected GitHub repositories, monitor new commits, and perform scheduled security assessments. Engineers can examine supporting evidence, modify proposed patches using Codex, and create draft GitHub pull requests. However, patches are not deployed automatically.

OpenAI is accepting requests for early access to Daybreak Red Team. Defense Factory is offered through a preview plugin in ChatGPT for workspaces with Daybreak access.

OpenAICodexWizSnykDaybreak RedDaybreak Defense FactoryEndor Labs
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in AI & Model Risk

Daylight Raises $80 Million Series B to Scale AI-Native Security Operations Platform Aura
AI & Model Risk

Daylight Raises $80 Million Series B to Scale AI-Native Security Operations Platform Aura

Israeli-American cybersecurity startup Daylight has closed an $80 million Series B round, bringing its total funding to $120 million. The round was led by Goldman Sachs Alternatives’ Growth Equity with participation from Okta Ventures, Bain Capital, Craft Ventures, Vintage Partners, and Maple Capital. Founded in 2024 and headquartered in New York and Tel Aviv, the company offers Aura, an AI-native platform that automates threat hunting, analysis, and containment while allowing flexible service models ranging from fully managed to co-managed operations. Aura also extends protection to AI platforms used by organizations, addressing risks such as prompt injection, risky MCPs, and rogue AI-driven activity. CEO Hagai Shapira emphasized that the agent-native model merges AI speed and scale with human judgment. The new capital will accelerate platform development, expand security and technology teams, and support growth in the US, EMEA, and APAC regions.

SecurityWeekNov 12, 2026Translated from English

AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
AI & Model Risk

AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets

Cybersecurity researchers at Arctic Wolf Labs have detailed how the open-source AI-driven penetration testing tool AntiFox was abused in real-world intrusions to compromise internet-facing web services and steal credentials from Amazon Web Services environments. Attackers leveraged compromised IIS servers to deploy ASPX web shells, enumerate configurations, extract database strings, and move laterally into cloud infrastructure. In multiple cases the activity progressed from credential validation to successful enumeration of dozens of AWS services and direct retrieval of production secrets via Secrets Manager. The disclosure highlights a growing trend of threat actors weaponizing autonomous agentic frameworks such as AntiFox and ARTEX to automate reconnaissance, exploitation, and post-exploitation at machine speed. Similar campaigns, including Operation Ghost-Campus attributed to Chinese actors, demonstrate how these tools enable rapid theft of API keys and large-scale automated fraud. Researchers note that roughly 45 open-source agentic attack frameworks now exist, lowering the barrier for less-skilled adversaries while increasing attack scale and persistence.

The Hacker NewsNov 11, 2026Translated from English

Hackers Deploy AntiFox AI Agents on Alibaba Cloud to Steal AWS Credentials
AI & Model Risk

Hackers Deploy AntiFox AI Agents on Alibaba Cloud to Steal AWS Credentials

Attackers are hosting self-managed instances of the open-source AntiFox agentic penetration testing platform on Alibaba Cloud to target web services and AWS environments. The infrastructure has been linked to vulnerability exploitation, webshell deployment, credential validation, configuration discovery, and AWS secret harvesting. Originally forked from ARTEX 0.1.1, AntiFox features a Chinese-language interface and allows users to deploy AI agents that automate mapping of exposed services and probing endpoints for vulnerabilities. Arctic Wolf researchers observed malicious activity where valid AWS IAM users and assumed EC2 roles were used to make hundreds of authenticated API requests, resulting in the theft of production secrets in some cases. Separate incidents involved reading, copying, and deleting S3 objects using compromised identities. The findings connect AntiFox to prior ARTEX-linked campaigns, including those attributed to the Chinese group Vapor Panda targeting over 200 organizations. AntiFox remains publicly available on GitHub with version 2.0 updates, despite publisher warnings against illegal use.

BleepingComputerNov 11, 2026Translated from English