Deep Dive
The Defender's Window Opens
Emanuel Mariel set the stage: we're in a rare moment where frontier AI capabilities are significantly ahead of open-weight models, but that gap is closing fast. OpenAI released GPT-6 Astra, its most capable model yet, seeing 26% more weekly active users on Codex for marketing and 108x adoption in legal work. But with capability comes risk. Mariel emphasized that cyber threats escalated dramatically — six months ago customers asked about AI safety, but one week before this keynote they all led conversations with cyber security concerns. OpenAI paused frontier training runs in August specifically to focus on safety and alignment. The company assembled a $1 billion fund and published an open letter signed by 500 organizations calling for an ecosystem response to close this window before attackers exploit it.
What Frontier Models Can Actually Find
Matt Sheats illustrated the stakes with the Thames Barrier — London's 40-year-old flood protection system most people ignore until it fails. Cyber defenders run systems society depends on the same way. Now AI changes what's possible: OpenAI's frontier models found a 23-year-old vulnerability in OpenBSD that went unnoticed for two decades. In Poland, their cyber models uncovered flaws in MicroTalk affecting releases back to 2013. But Matt was explicit about one critical lesson: findings aren't interesting, fixes are. Every traditional security tool generates findings; the gap that matters is between identifying a vulnerability and actually deploying a working patch before attackers exploit it. That's where the Defender's Window closes fastest.
Astra: More Capable, More Aligned
Lena presented the benchmarks behind Astra's advancement. Using Exploit Gym — which tests whether models can turn known vulnerabilities into working exploits across Chrome, JavaScript engines, and Linux kernels — Astra achieved 40% successful completions while using far fewer output tokens than GPT-5 Soul at 30%. That efficiency matters: it lets defenders run more thorough security testing with fixed budgets. More important was alignment: when given a test that included an out-of-scope target Astra could exploit as a shortcut, Soul took that shortcut 48% of the time. Astra succeeded zero times. That's not just a number; it means you can delegate more complex work to the model with greater confidence it will respect boundaries even when a task gets hard. The model was trained on frontier reasoning plus specialist cyber training including vulnerability understanding, exploit development, and result verification.
Codex Security Red and Blue: Practical Implementation
Vanessa walked through the concrete workflow. Codex Security comes in two Daybreak tiers. Daybreak Red gives approved teams access to specialist models for advanced red teaming and turning crashes into working exploits. The new Codex Security Red product runs agents in OpenAI-hosted isolated sandboxes with network controls overseen by a guardian agent — so you see everything the model does while containing what it can reach. For most defenders, Daybreak Blue is the starting point: frontier general-purpose models with safeguards tailored for authorized security work like code review, alert investigation, vulnerability discovery, and patch creation. Vanessa demonstrated scanning Ladybird, a pre-alpha open-source browser, by running a full scan with high reasoning effort. The model reviewed 28,000 files, generated a threat model, surfaced candidate vulnerabilities, then validated them. One finding surfaced: a JavaScript cache vulnerability. Instead of stopping at the finding, Codex generated a patch, let the engineer review it, verify it worked, and commit it — all within the same interface. The real power appeared when scaling: sub-agents opened Jira tickets and pull requests, notifying engineers to review. Engineers could merge patches without manual remediation.
Defense Factory: OpenAI's Internal Blueprint
Lou revealed how OpenAI operationalized this internally. The company called a code red and mobilized 250 people across engineering, security, and research into a cross-functional team. They built the first iteration of their defense factory by taking a standard security loop — inventory, discovery, validation, ownership assignment, remediation, verification — and inserting agents into each stage. The tech stack didn't change: source code scanning, traditional security tools, and workflows stayed. What was new: agents with composable skills running inside isolated virtual machines with development containers. Those containers packaged all dependencies and allowed OpenAI to hook in monitoring tools like Falcon sensors. The agents iterated across their entire infrastructure, achieving metrics that look impossible by industry standards: false positive rate below 1% (typical: 50-60%), ownership assignment at 90%, and less than 1% fix rollback rate. Every workflow fed inputs from various systems into the environment, ran agents, and produced validated outputs — whether that was dynamically checking if a vulnerability was reachable, assigning it to the right team, or confirming a fix actually worked. OpenAI is now productizing this and working with a handful of early customers, with broader rollout planned over coming weeks.