The Defender's Window: Cyber security keynote

Emanuel Mariel, OpenAI’s general manager for Europe, the East and Africa, opens with a clear thesis: we are at a moment of rapid AI capability growth, and the central question that comes with it is trust. He frames safety as trust in the models, in the organizations building them, and in the external world, which is where cyber security comes in.

Capability growth and the question of trust

Mariel points to scientific progress, including a Navier-Stokes mathematics problem reportedly solved a few weeks earlier, and to the release of GPT-6 Astra, which he calls OpenAI’s most capable and most aligned model so far. Adoption is growing quickly. Weekly active Codex users for marketing rose 26%, legal usage reportedly rose 108x, and more than a billion people use GPT weekly. He illustrates the business impact with Stadler, a Berlin SMB with 650 employees that runs 145 agents alongside its staff and reports 30 to 40% efficiency gains.

Safety has been pushed further up the agenda. OpenAI has grown its safety team, invested heavily in safety compute, and paused its most recent training runs for a few weeks to focus on alignment. Mariel also notes a shift in customer conversations: six months ago they were not about cyber, and in the past few days nearly every discussion started with cyber security concerns.

The defenders’ window

Mariel describes the defenders’ window as the gap between what OpenAI’s frontier models can do and what open-weights models are rapidly catching up to. This is the time defenders have to use the best capabilities before the same tools become widely available to attackers. The urgency explains why around 150 people showed up to a session that rarely fills in that way.

An ecosystem response, not a single-vendor show

Mariel insists this is an ecosystem effort and not an OpenAI show. An open letter, signed by around a hundred companies (Matt later cites 500 organizations), calls for coordinated action. He assigns roles to each group:

• Leaders must make cyber the number one priority in their companies. Mariel says the US already treats it this way, while Europe is lagging but catching up.
• Technology partners such as Darktrace and Checkpoint connect models to real organizations so they can be deployed and acted on quickly. He stresses that timing is critical.
• Governments act as facilitators and accelerators. OpenAI is working with Ukraine, whose cyber defence faced 6,000 attacks last year, and Mariel says ENISA recently used OpenAI’s models to find vulnerabilities it had not expected to find, even at small scale.
• OpenAI commits to making sure cost is not the barrier. Hospitals and utilities should be able to use its cyber models through trusted access, supported by a $1 billion fund announced two weeks earlier.

From findings to fixes: the defense factory concept

Matt, OpenAI’s head of engineering for cyber, opens with the Thames Barrier, which has protected central London from tidal flooding for more than 40 years. Its value is invisible because someone else takes responsibility for it, and he argues that every critical system works the same way. Frontier models are now finding weaknesses that went unnoticed for years. He cites a 23-year-old flaw in OpenBSD and MicroTalk vulnerabilities in releases going back to 2013. He believes defenders currently have a head start, but he warns it will not last.

His central argument is that findings are not the valuable output. Scanners have produced findings for years, and each one then triggers validation, deduplication, a check for whether the risk was already accepted, and so on. The real goal is verified fixes. OpenAI responded internally by pulling together its security, applied engineering, and research teams to build what it calls a defense factory. In that model, models give agents capabilities, skills give them repeatable workflows, and development environments let them run and validate software. The ambition is continuous defense.

Matt describes a national version through the Cyber Shield initiative, which uses agents to find vulnerabilities and moves toward automated remediation across critical infrastructure, with the UK government also interested. His view is that every organization needs its own defense factory. OpenAI has advantages most organizations lack: dedicated security teams, deep expertise, and access to frontier models. He summarizes the stance as ’their security is our security.’ The three layers he describes are frontier models that provide capability, the Daybreak program that gives eligible defenders access, and Codex Security, which applies those capabilities to defensive and authorized offensive testing.

Model capabilities, benchmarks, and safeguards

Lou, who leads the cyber program for EMEA go-to-market, presents GPT-6 Astra as a major step forward in software engineering, professional work, and computer use. It has also been trained to find more vulnerabilities, including zero-days, and to act as a more capable red teamer. He stresses cost-efficiency alongside capability.

To measure exploitation ability, OpenAI uses ExploitGym, which tests whether a model can turn a known vulnerability into a working exploit in targets such as Chrome’s JavaScript engine and the Linux kernel. Triggering a crash does not count. Astra completes around 40% more challenges than the previous model while using far fewer output tokens, which he presents as the key progress: harder tasks completed with less compute.

A concrete example comes from Chrome. Working with researchers, the models helped uncover two previously unknown vulnerabilities and chain them into an exploit, where one flaw enabled memory corruption and the second broke through another protection layer. The researchers validated and reported the chain to Google, which shipped a fix. Patch the Planet, a joint initiative with Trail of Bits, funds security researchers who work with maintainers of projects such as Python, curl, and Go. In its first week, it merged 37 patches, and AIOHTTP maintainers fixed eight reported issues within hours.

Lou is candid about the risks. Astra is the first model to reach OpenAI’s cyber critical threshold, and he quotes Sam’s principle that ‘we shouldn’t be taking risks on behalf of humanity’ and that ‘people need to remain in control.’ Safeguards include training models to refuse harmful requests, detecting and blocking abuse, monitoring reasoning and actions, and tighter restrictions for higher-risk accounts. In one alignment test, an out-of-scope target offered a shortcut. The earlier model exploited it in around 48% of cases, while Astra exploited it zero times.

Daybreak Red, Daybreak Blue, and Codex Security Red

Daybreak has two tiers. Daybreak Red is for approved security teams doing advanced red teaming and weaponized exploit development, such as turning a crash into a working exploit or chaining weaknesses to see how far an attacker could get. Daybreak Blue is the starting point for most defenders and provides general-purpose models with safeguards tailored for authorized security work, including code review, alert investigation, vulnerability discovery, and patching. It currently includes GPT-6 Soul and Luna, with Astra coming soon.

With Red-level capability comes a need for boundaries. OpenAI announced Codex Security Red, a managed penetration-testing service. Teams define scope and rules of engagement in Codex. Investigation agents run in OpenAI-hosted, isolated sandboxes, and the team follows activity and evidence through a dashboard. Outgoing requests pass through network controls, with a guardian agent reviewing the traffic. The aim is to remove the infrastructure burden from security teams while keeping visibility and control.

A live workflow: from scan to merged patch

Vanessa, a cyber deployment engineer, demonstrates the workflow on Ladybird, a pre-alpha open source browser that is being hardened through Patch the Planet. She recommends a full initial scan with high or extra-high reasoning and the most capable available model. The main differentiator she highlights is context. Teams can supply attack vectors, areas of focus, and enterprise context such as compensating controls, business logic, and how fraud is defined. The scan reviewed 28,000 files, built a threat model, surfaced candidate vulnerabilities, and validated them. One example, a shared JavaScript bytecode cache issue, was confirmed as a true positive with high impact and high likelihood.

Findings are then converted into patches using a fix-finding skill. Patches can be applied locally and verified. Vanessa also describes a SECURITY.md file, analogous to AGENTS.md but for security, that captures repo-level priorities and trust boundaries and is committed for future scans. Finally, sub-agents generate and validate patches for grouped findings, open Jira tickets and draft GitHub PRs, and notify engineers on Slack. Pipeline checks ensure there are no breaking changes before a reviewer approves. At enterprise scale, the CLI and SDK handle bulk scans across thousands of repositories, can run in CI to flag vulnerable components or risky dependency upgrades, and are open source.

Inside OpenAI’s defense factory

Lou, field CTO for cyber at OpenAI, describes the internal build-out. OpenAI declared an internal code red and assembled a cross-functional team of around 250 people across engineering, security, and research. The loop covers inventory of the attack surface, discovery across the estate with cyber models, dynamic validation (is it a duplicate, is it reachable), ownership assignment through systems such as Slack, PagerDuty, and GitHub, and verified remediation. Existing tools stay in place, and the new elements are agents with organization-specific skills and isolated environments.

Architecturally, the system runs inside the customer’s own network so source code stays protected. Agents run in virtual machines, which provide isolation and kernel-level monitoring of tool use, and inside dev containers built on an open standard for reproducibility. Security tooling such as endpoint sensors can be hooked in. Reported results include a false positive rate below 1% in dynamic validation, where Lou says many organizations see 50 to 60%, ownership assignment accuracy around 90%, and a fix rollback rate below 1%. OpenAI is now productizing this with a limited set of customers, with broader rollout planned over coming weeks and months.

Closing: practical next steps

Matt closes by urging attendees not to wait for products. He recommends three steps: apply for the Daybreak program, start with the Codex Security plugin on a single repository and scale up through CI, and use the CLI and SDK to build custom tools. He also recommends packaging agent environments in dev containers so tests run reproducibly and system context and ownership stay clear. He returns to the defense factory diagram, where models provide capability, Codex and development tools make it usable, and security workflows provide starting points. He ends optimistically, arguing that because software is shared, every fix contributed and every lesson shared helps another defender move faster.

• Tags:
• Red Teaming
• Cyber Defense
• GPT-6 Astra
• Defense Factory
• Daybreak
• Codex Security
• Vulnerability Remediation
• Defenders Window
• Continuous Defense
• Patch the Planet
• Agentic Security
• Dev Containers
• AI Safeguards
• Exploit Benchmarking