OpenAI has introduced a “Defense Factory” model for continuous, agent-driven vulnerability discovery and remediation, warning that traditional cyber defenses may not keep pace as AI agents can chain exploits and sustain long-running operations.
The company’s approach responds to a rapidly changing threat landscape in which increasingly capable open-weight models can help attackers automate reconnaissance, retain knowledge across sessions, identify relationships between weaknesses, and pursue complex attack paths at machine speed.
OpenAI argues that defenders currently retain a structural advantage because they can provide authorized AI agents with direct access to proprietary source code, internal asset inventories, development environments, security findings, and engineering workflows.
OpenAI Builds ‘Defense Factory’ as AI Agents Gain Ability
Attackers generally lack this internal visibility and must rely on externally available tools and broadly distributed models.
However, that advantage may not last. Long-running agent fleets can investigate systems continuously, test multiple attack paths simultaneously, and potentially connect vulnerabilities that would be difficult for a human operator to correlate.
A weakness that once required hours or days of manual research could eventually be discovered, validated, chained with another flaw, and exploited before a conventional security team completes triage.
OpenAI describes this temporary advantage as the “defender’s window,” the period during which organizations can apply more advanced cyber models to protect their own infrastructure before comparable offensive capability becomes widely available.
OpenAI said it tested the approach during an internal security sprint involving more than 250 people and covering over 100 service areas.
The effort used its cyber-focused models to identify, validate, and remediate vulnerabilities across internal systems, treating the work with the urgency normally associated with incident response.
According to Openai, it remediated 53 urgent or high-priority issues on the first day of the sprint. The exercise evolved from a concentrated security campaign into a broader plan for a persistent defensive operation.
Instead of treating scanning, triage, ownership, remediation, and verification as separate processes, OpenAI is connecting them into a single loop.
Agents can investigate incoming findings, test whether they are exploitable, identify affected services, locate responsible engineering teams, and prepare tested patches for human review.
The Defense Factory is the operational layer that connects a company’s existing security and developer tools.
Source-control platforms, vulnerability scanners, issue trackers, cloud inventories, artifact registries, secret stores, and model endpoints provide the data and access agents need.
Agents run in isolated, reproducible, and ephemeral development environments. These environments include the relevant application code, dependencies, configurations, and services needed to reproduce a vulnerability and test a proposed fix.
Each run is separated from the next, limiting the risk of state contamination and helping teams produce repeatable results.
A control plane manages workload orchestration, policy enforcement, credentials, and access boundaries. Monitoring and audit systems oversee host activity, infrastructure security, and agent behavior, providing visibility into actions taken by cyber-capable models.
OpenAI’s defensive loop begins with an inventory of assets, services, exposed endpoints, code repositories, and ownership information. Agents then scan systems and analyze findings, then dynamically validate whether reported issues can be reproduced and exploited.
Validated issues are assigned to responsible teams, while agents can generate and test remediation patches. Deployed fixes are then independently verified, ensuring that a merged code change has actually resolved the security problem in production.
OpenAI reported that its agent-assisted ownership workflow achieved a 90.6% accepted assignment rate. Its deduplication process identified 37% of findings as duplicate reports, while repeatable runtime validation reduced the false-positive rate after dynamic testing to 0.81%.
The company stressed that it should implement autonomy gradually. Human reviewers remain responsible for setting security boundaries, approving consequential changes, resolving ambiguous cases, and independently checking deployed remediation.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
