OpenAI has published the Defense Factory, an account of how it rebuilt its own security operation. The idea is a loop that runs without stopping: agents find a vulnerability, reproduce it, prepare a patch, and confirm the fix actually landed. People move toward setting boundaries and handling the exceptions. The urgency behind it is straightforward. Attackers are automating their work with increasingly capable open-weight models, and defenders who move at human speed will simply be outpaced.
The Time Defenders Have Left
Automated attacks are no longer a researcher's thought experiment. Agents carry what they learn from one session into the next, build a working picture of a system, and connect weaknesses that were never useful in isolation. Attack paths that could not be assembled in a single pass now come together over time. Because agents can be run in fleets, the scale of that work leaves human review-and-patch cycles far behind.
Defenders hold two cards of their own. They can point agents directly at their source code, and they can use frontier models that outclass the widely available open-weight models attackers reach for. OpenAI calls the margin this creates the defender's window. It is not permanently open. Without continuous defense in place, the gap closes.
It Started with an Internal Code Red
The Defense Factory did not begin as a blueprint. As newer model capabilities allowed deeper inspection of its own systems, OpenAI declared an internal code red and pulled Security, Applied, and Research into a coordinated sprint. More than 250 people were mobilized across more than 100 service areas.
On the first day alone, 53 issues classified as urgent or high priority were closed out. The executive leading the effort told the company that defenses were being strengthened with the urgency of an incident, and that the work took precedence over everything except critical business operations. Rather than let the sprint end as a one-off, the team turned it into a standing loop. That loop is the Defense Factory.
Five Stages, Running Continuously
The loop consists of inventory, discovery, dynamic validation, ownership assignment, and verified remediation. Each stage reads from and writes to a shared body of context, so the next pass reuses the system map and ownership data built earlier. Nothing restarts from zero, which lets later passes concentrate on changes and unresolved risk.
The numbers show what the engineering actually solved. Automated ownership routing reached an accepted rate of 90.6 percent, and 37 percent of reports were merged as duplicates. Findings reproduced at runtime in isolated environments came to 19.5 percent, and the false-positive rate after that dynamic validation fell to 0.81 percent. Patch generation was handled entirely by Codex, with a rolled-back fix rate of 0.53 percent.
The setbacks are described just as plainly. Early severity labels were too coarse, and classifications shifted depending on the instructions agents received. Versioning the rubric and the prompts, adding repeatable evaluations, and recording reviewers' expected priorities and reasoning brought that under control. Automatic routing was deliberately paused until deduplication improved.
What the System Is Built From
The architecture assumes you are wiring it into tools you already run. Source control means GitHub or GitLab, scanning means Snyk, Semgrep, or Tenable, and issue tracking means Jira, Linear, or ServiceNow. The Defense Factory sits between them as the connective layer, running agents inside reproducible, isolated environments.
The agents themselves are Codex, available as a desktop app, a CLI, and a security-focused CLI depending on the task. Alongside general-purpose models, the security work uses Daybreak Blue for defense and Daybreak Red for the attacker's perspective. The environments being rebuilt for every run matters as much as the models: state from one run must not contaminate the next, or reproducibility disappears.
OpenAI is not alone in this direction. Teams at Cloudflare, Ramp, and Google are exploring the same approach and have published accounts of their own work.
Three Ways to Start
The recommendation is to pick a single workflow rather than assemble the whole system at once. Three entry points are offered: a briefing deck for making the case internally, an application process called Daybreak for access to advanced cyber models for authorized defensive work, and the Codex Security plugin for trying detection through patch preparation. A technical blog post covering the details is said to be coming soon.
Summary
The Defense Factory is not a new scanner or a new model. It is an operational design that rearranges existing tools into something agents can reach. Its value lies in publishing what a 250-person sprint produced alongside concrete figures such as a 0.81 percent false-positive rate and a 0.53 percent rollback rate. The path it describes is worth borrowing too: automation was not switched on everywhere at once, but extended only after human review had earned enough trust to let go.
