OpenAI opens early access to AI agents for testing web-app security

OpenAI is offering early access to Daybreak Red Team, AI agents designed to test web applications for security weaknesses. The promise goes beyond producing a list of suspicious code: the agents can investigate whether a reported flaw is real and later check whether a proposed repair blocks the attack.

The offering uses coordinated agents to examine application source code and context, investigate possible attack paths and confirm vulnerabilities, according to Help Net Security. That work connects code inspection with an investigation of how a weakness could be used, rather than stopping at an initial warning that something may be wrong.

Existing findings can enter the investigation

Red Team does not have to originate a finding to investigate it. Security teams can bring suspected vulnerabilities from three existing sources into the validation process:

• Results from code scanners.
• Submissions to bug-bounty programs.
• Reports received through vulnerability disclosure.

The resulting evidence is intended to help teams prioritize repairs. The useful distinction is between receiving a report of a possible weakness and having evidence that supports treating it as a confirmed vulnerability requiring attention.

A repair gets its own test

Once a patch is ready, Red Team can test whether it blocks the exploit. This is a separate question from confirming the original flaw: the assessment shifts from whether an attack works to whether the proposed change stops it. For teams with early access, that makes patch testing part of the offering, rather than leaving the workflow at a validated finding.