---
type: "post"
id: "as-ai-becomes-more-capable-at-finding-vulnerabilities-1796e1"
slug: "as-ai-becomes-more-capable-at-finding-vulnerabilities-1796e1"
title: "As AI becomes more capable at finding vulnerabilities, defenders need to put it to work before attackers do."
description: "OpenAI describes an internal security sprint involving more than 250 people and the foundations of a continuous, agent-first operation for finding, validating, and fixing vulnerabilities."
retrieval_nugget: "OpenAI describes an internal security sprint involving more than 250 people and the foundations of a continuous, agent-first operation for finding, validating, and fixing vulnerabilities. The account matters to AI builders because it treats isolation, orchestration, ownership, and independent retesting as core parts of deploying agents in security work—not optional safeguards around a model."
published_at: "2026-11-03"
updated_at: "2026-11-03"
record_date: "2026-11-03"
date_kind: "published_at"
topics: ["codex","google"]
entities: ["OpenAI","Defense Factory","Codex","Cloudflare","Ramp","Google"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "OpenAI now describes a Defense Factory and an internal security sprint using its latest cyber models, mobilizing 250+ people to find, validate and fix vulnerabilities."
prior_refs: ["https://newruntime.com/posts/to-our-knowledge-frontier-ai-found-these-vulnerabilities-493b48/"]
source_url: "https://openai.com/the-defense-factory/"
source_urls: ["https://openai.com/the-defense-factory/"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:as-ai-becomes-more-capable-at-finding-vulnerabilities-1796e1"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/as-ai-becomes-more-capable-at-finding-vulnerabilities-1796e1/","markdown":"https://newruntime.com/posts/as-ai-becomes-more-capable-at-finding-vulnerabilities-1796e1.md","json":"https://newruntime.com/posts/as-ai-becomes-more-capable-at-finding-vulnerabilities-1796e1.json"}
markdown_url: "https://newruntime.com/posts/as-ai-becomes-more-capable-at-finding-vulnerabilities-1796e1.md"
---

# As AI becomes more capable at finding vulnerabilities, defenders need to put it to work before attackers do.

## Retrieval answer

OpenAI describes an internal security sprint involving more than 250 people and the foundations of a continuous, agent-first operation for finding, validating, and fixing vulnerabilities. The account matters to AI builders because it treats isolation, orchestration, ownership, and independent retesting as core parts of deploying agents in security work—not optional safeguards around a model.

## Summary
OpenAI describes an internal security sprint involving more than 250 people and the foundations of a continuous, agent-first operation for finding, validating, and fixing vulnerabilities. The account matters to AI builders because it treats isolation, orchestration, ownership, and independent retesting as core parts of deploying agents in security work—not optional safeguards around a model.

## What happened
OpenAI says it used its latest cyber models in a recent internal security sprint to find, validate, and fix vulnerabilities across the company. More than 250 people from Security, Applied, and Research took part, and the work was treated with the urgency of incident response. The page reports that the effort covered more than 100 service areas. Its chart presents five complete weeks of selected Urgent and High finding reports marked Done or Resolved relative to a peak week; it does not provide a basis for independently confirming that every recorded resolution became a deployed remediation.

The sprint is presented as the starting point for the Defense Factory, which OpenAI defines as a continuous, agent-first operation for finding and fixing vulnerabilities. The proposed workflow connects existing security and engineering tools—such as source-control systems, security scanners, and issue trackers—to agents. Reusable skills describe workflows including security scanning, triaging findings, and fixing them. OpenAI lists Codex Desktop, Codex CLI, and Codex Security CLI among agent options, and names general-purpose and security model families, but does not describe this as a generally available product or provide pricing or access terms.

A key part of the design is the execution environment. OpenAI says agents need isolated, reproducible environments containing the right code, dependencies, and services to reproduce vulnerabilities and prepare tested fixes. Its diagram separates a control plane, including workload orchestration, policy enforcement, and a credential proxy, from development environments containing containers, an agent harness, skills, and the application. Host monitoring and agent audit are among the oversight components. The page describes the architecture, not a complete implementation guide with configuration details.

The intended defensive loop has five stages: inventory systems, discover findings, dynamically validate them, assign an owner, and remediate with verification. OpenAI contrasts this with common bottlenecks such as findings awaiting investigation, duplicate reports, unclear ownership, and merged fixes that remain unverified. The company says it aims to automate investigation, test exploitability, route findings to owners, and send tested patches to reviewers with evidence. It also says deployed fixes should be independently retested. OpenAI names Cloudflare, Ramp, and Google as other teams exploring this broader approach.

## What the archive adds
This is a new operational account on a known theme, rather than a wholly new security thread. [Cloudflare’s earlier case](https://newruntime.com/posts/cloudflare-links-vulnerability-discovery-to-defense-with-openai-10fe99/) reported its own results from AI-assisted vulnerability work, including a 10× reduction in development resources and a three-day Codex rebuild costing $1,100. OpenAI’s new account adds an internal sprint, the Defense Factory architecture, and a proposed continuous workflow; it does not independently validate Cloudflare’s results.

## Trend signal
The account supports [agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/): OpenAI places isolated environments, workload orchestration, policy enforcement, credential mediation, monitoring, and audit around agents that investigate and prepare fixes. The design makes the runtime and its controls central to the security model, rather than relying on instructions to the agent alone. The source describes an approach, not proof that it has reached sustained production effectiveness.

## Why now
OpenAI says new model capabilities let its teams examine their systems more deeply, prompting an internal “code red” and a coordinated sprint across hundreds of systems. The company frames the work as a response to increasingly capable agents and more available open-weight models that could accelerate attackers’ operations. Its diagrams describe the defender’s window conceptually; they are explicitly illustrative, not measured results or a forecast.

## Connections to other events
An earlier OpenAI statement in the archive framed frontier models finding vulnerabilities before attackers as a possible “Defender’s Window.” This page turns that argument into an operational proposal: give agents access to code and tools, constrain their work in reproducible environments, and build a continuous route from finding to verified remediation. The earlier Cloudflare case provides a separate example of AI-assisted security work, while OpenAI’s source identifies Ramp and Google as teams exploring related approaches.

## Why it matters
For teams building with AI, vulnerability discovery is only one step in a useful security system. Agents need a way to reproduce findings against the right dependencies and services, avoid unsafe access to credentials, route work to accountable owners, and produce patches that humans can review. A system that measures activity or marks a finding resolved without checking the deployed fix risks confusing output volume with reduced exposure.

OpenAI’s design is a useful checklist for organizations considering agent-assisted security: connect existing tools through controlled interfaces, isolate execution, log agent activity, and make verification an explicit stage. But this is a description of OpenAI’s approach, not evidence that another team can reproduce its results or that full automation is appropriate for every vulnerability class. The practical lesson is to design the control and evidence loop alongside agent capability.

## Limits and uncertainty
The page does not name specific vulnerabilities found in the sprint, disclose a complete breakdown of findings, or provide independent validation of its reported counts. “Done” or “Resolved” in the chart does not establish that a fix was deployed and independently retested. OpenAI does not publish costs, comparative performance, false-positive rates, or details sufficient to reproduce the system. Nor does the page establish that the Defense Factory is available to customers. Its claims about attacker capabilities and the defender’s window are partly explanatory framing; the capability chart is explicitly illustrative rather than measured or predictive.

## Skill to build now
Map one vulnerability workflow before adding an agent: identify where findings enter, how a team reproduces them, who owns the fix, and what evidence proves the deployed change works. Then test whether the relevant tools can be exposed through constrained interfaces in a disposable, reproducible environment. This small exercise surfaces missing permissions, ownership, and verification steps that an agent cannot safely solve on its own.

## Reader takeaway
OpenAI’s security sprint is notable less as a claim that AI can find bugs than as a blueprint for wrapping that capability in an operational loop. For builders, isolation, policy enforcement, accountable ownership, and retesting are part of the agent system itself. Treat the account as an architecture and direction, not as independent proof of remediation outcomes or a ready-to-buy service.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Codex](https://newruntime.com/topics/codex.md): Explore the codex topic hub.
- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)