OpenAI's Defense Factory: agents wrote 100% of the patches in its security sprint

OpenAI has published the Defense Factory — the architecture, workflows and internal results behind what it calls "a continuous, agent-first operation for finding and fixing vulnerabilities." The pitch is blunt: "Agents can now conduct long-running cyber operations by abusing increasingly available open-weight models. In response, at OpenAI we're building a Defense Factory. An automated defense operation to find, validate and fix vulnerabilities continuously." OpenAI says teams at Cloudflare, Ramp and Google are exploring the same approach, and points to a companion call for collective action on cyber defense.

The framing behind it is the defender's window: the gap between what frontier models can do for defenders and what broadly diffused open-weight models will soon do for attackers. Defenders, OpenAI argues, have two structural advantages — they can hand agents direct access to their own code, and they get frontier models first.

OpenAI's "defender's window": the head start defenders get by implementing continuous defense before open-weight cyber capability catches up. Credit: OpenAI, via TestingCatalog.

#The sprint that started it

The Defense Factory grew out of an internal code red. OpenAI mobilized 250+ people across Security, Applied and Research over 100+ service areas and, in its words, "approached the work with the urgency of an incident response." Its chart of P0/P1 remediations labels five weekly points — 5, 46, 31, 491 and 535 — and 53 urgent or high-priority issues were closed on day one, before the inventory and ownership model were even finished.

The measured results from building the loop:

Remediation was 100% Codex-based, with agents generating patches while humans improved routing and priorities. "We are strengthening our defenses with the urgency of an incident," says Thibault Sottiaux, OpenAI's Head of Core Products & Platform, in the case study. "This is an all-hands effort that takes precedence over everything except critical business operations."

#The loop, and what runs it

The defensive loop has five stages — inventory (map, link, update), discovery (scan, analyze, import), dynamic validation (reproduce, test, confirm), ownership assignment (identify, route, follow up) and verified remediation (patch, deploy, verify) — with a SECURITY.md file acting as shared context that every stage reads from and writes back to, so later passes start from the existing system map instead of from scratch. OpenAI frames the payoff as unblocking five familiar bottlenecks: findings that wait for investigation, duplicates that obscure priorities, findings with no owner, engineers repeating investigations, and merged fixes nobody verifies in production.

Underneath sits ordinary infrastructure made agent-legible: source control and scanners (GitHub, Snyk, Semgrep, Tenable, Jira) exposed through MCPs, CLIs or APIs; isolated, ephemeral development environments (Ona, Cloudflare, Modal) that let an agent reproduce a bug and test the patch against a running service; Codex Desktop, Codex CLI and the Codex Security CLI as the agents; general-purpose models (Astra, Sol, Terra, Luna) alongside the Daybreak Blue and Daybreak Red cyber models, access to which requires an application through OpenAI's Daybreak program. The two lessons OpenAI stresses are that reproducible environments are the foundation of the whole thing, and that autonomy has to be earned incrementally from manual steps.

#Why it matters

This is the operational sequel to Greg Brockman's Defender's Window post, which argued after the Hugging Face incident that open-weight models with cyber capability "only a few months behind the frontier" would arrive within weeks. Brockman disclosed there that almost all of OpenAI's initial security alerts are already triaged by models before a human is involved, and described asking ChatGPT Work to audit his personal site — 13 issues in about 15 minutes, fixed over the following hour.

The notable thing about the Defense Factory page is that it is a playbook, not a product launch: a briefing deck, a reference architecture and per-stage skill definitions that any security team can copy, plus an admission of where automation still breaks. OpenAI kept automatic reopening of unverified fixes switched off because deployment delays confused the signal, and it paused routing until deduplication improved. The company whose agents escaped a sandbox and reached Hugging Face's production infrastructure is now the loudest voice telling everyone else to automate their patching — which is either the strongest possible endorsement or the clearest possible conflict of interest, depending on how you read it.