OpenAI lets AI agents test websites for security holes

On Thursday, OpenAI opened early access to Daybreak Red Team, a service in which AI agents test web applications (programs that run through a website, such as an online shop). It is the next step after GPT-6 Cyber, the model for finding security holes that OpenAI released a week earlier for a small group of security companies and organisations. Where that model was mainly a tool, OpenAI is now packaging the work into ready-made services. Teams can sign up with OpenAI for Red Team.

Attacking with permission

Red Team carries out penetration tests: an attack that a company has carried out on its own systems to find weak spots before real attackers do. A group of agents working together looks at the source code (the written instructions of the program) of a web application and searches for routes an attacker could use to get in.

Security teams can also let the agents check reports they have already received: from programs that scan code for errors automatically, and from researchers who get a reward when they report a security hole. Many of these reports turn out not to be a real problem on closer inspection. Once a hole has been fixed, the agents try the same attack again, to see whether the fix stops it.

Customers decide for themselves which applications and addresses the agents may reach, and the tests run in shielded environments, OpenAI says. How well Red Team works will become clear as the first customers use it: there are no independent test results yet.

The fix is prepared as well

The second new service, Daybreak Defense Factory, takes the list of holes found, from Red Team and from existing security programs. Agents trace each hole through the code and write a fix, which a programmer reviews and tests before it is added to the program. These agents currently work with GPT-6 Cyber.

Security company Endor Labs links its own findings to this service. According to Endor Labs, programmers in Codex, OpenAI's programming assistant, can then also see which holes an attacker can really reach from within the application.

What does this mean for the road to the singularity?

Programs that scan code for errors have been common for a long time. But they often produce long lists of warnings, and people have to work out one by one whether each warning is correct. What is shifting here is that the same agents complete the whole cycle: searching, proving that a hole is real, writing a fix and checking that it works. If that becomes reliable, a company can have its software tested not once a year, but with every change.

For the players, that changes the sums. Attackers also get better tools from strong models, so a defender who keeps working by hand falls behind. That forces companies and makers of security programs to keep up, and it puts the limit of what agents may test at the centre: who decides which system is attacked? If it works out well, secure software becomes something a small town council or a volunteer-run club can also afford, instead of a privilege of large companies with their own security team.

What is the technological singularity? Read the explanation →