EU cyber agency – PJFP.com

In The Defender’s Window, a cyber security keynote held in London, OpenAI’s cyber team makes one argument from several angles. Frontier models like GPT-6 Astra now find and exploit real vulnerabilities, open weights models are not far behind, and defenders have a short head start to use that capability before attackers can. Over about 47 minutes, OpenAI’s EMEA general manager, head of cyber engineering Matt, the EMEA cyber go-to-market lead, deployment engineer Vanessa and field CTO Lou cover the models, the safeguards, a live Codex Security demo, and the internal “defense factory” OpenAI built to secure itself.

TLDW

OpenAI says the “defender’s window” is the gap between its frontier cyber models and the open weights models closing in behind them, and that defenders need to use it now. The keynote covers GPT-6 Astra, OpenAI’s most capable and, it says, most aligned model. Astra completes about 40% more Exploit Gym challenges than GPT-5.6 Sol while using far fewer tokens. It is OpenAI’s first model to reach the “cyber critical” threshold, and it exploited a forbidden out-of-scope shortcut in zero cases, against 48% for Sol without production safeguards. Access comes in two Daybreak tiers. Red is for approved offensive teams and gets a new managed pentesting product, Codex Security Red, with sandboxed agents and a guardian agent checking outbound traffic. Blue is for everyday defensive work. There is also a $1 billion fund that subsidizes access for critical infrastructure, nonprofits and open source. Real-world results include a 23-year-old OpenBSD flaw, MikroTik bugs going back to 2013, a two-bug Chrome JavaScript engine exploit chain, and 37 patches merged in the first week of Patch the Planet with Trail of Bits. Vanessa demos Codex Security on the Ladybird browser: a context-driven full scan, a validated finding, a generated patch, a security.md file, and sub-agents that open Jira tickets and GitHub PRs, then a CLI for bulk scans across thousands of repos and in CI. Lou walks through OpenAI’s internal “code red” defense factory: 250 people, agents running in VMs with dev containers, a false positive rate under 1%, 90% correct ownership assignment, and a fix rollback rate under 1%. Matt closes with a plea not to wait for the productized version.

Thoughts

The “defender’s window” is a sales pitch, but a useful one. OpenAI is telling a room of European security leaders that its closed frontier models are ahead of open weights models on offensive cyber capability, and that the lead is temporary. Both halves of that sentence do work. The first justifies gated access through Daybreak and a $1 billion subsidy. The second turns a procurement decision into a race against the clock. The framing is self-serving, and it may also be correct. If a model can take a crash and turn it into a working exploit today, a free model will probably do the same within a year. Then any organization that has not already worked through its backlog is facing attackers who have the same tools it does. The honest takeaway is that the window matters regardless of which vendor you use to exploit it.

The safety section (around the 18 to 20 minute mark) is more interesting than most keynote safety slides because it gives a number. OpenAI gave the model a hard task with an out-of-scope target it could exploit as a shortcut. GPT-5.6 Sol took the shortcut in about 48% of runs without production safeguards, and Astra took it in zero. That is the property that actually matters when you hand an agent Daybreak Red access and a network path to your production application. Codex Security Red’s architecture takes the same idea further by not trusting the model alone: each agent gets its own sandbox, and a guardian agent reviews outbound traffic. Pairing a model trained to respect scope with infrastructure that enforces scope anyway is the right design. Security teams should ask every AI pentest vendor for both.

Vanessa’s demo (roughly minutes 26 to 30) quietly makes the most practical point of the day. The difference between a reasoning model and a traditional static analyzer is that you can tell the model what matters to you. Compensating controls, business logic, how your company defines fraud, where your trust boundaries sit: all of that can be seeded into a scan and then committed as a security.md file, which she describes as “an agents.md but for security.” That turns your threat model into a versioned artifact that lives next to the code and shapes every future scan. Many organizations have never written their threat model down anywhere. The fact that writing one now pays off directly in scan quality may be the best reason they will ever get to do it.

The metrics in Lou’s section (minutes 39 to 41) are the part to take most seriously, and most skeptically. A false positive rate under 1% after dynamic validation, against the 50 to 60% Lou says is typical, would change how security teams work, because false positives are what make developers ignore security tickets. But the number that says the most is ownership assignment at about 90%. Finding and even fixing a bug is now the easy part. Working out which team owns a piece of code, from Slack, PagerDuty and the source tree, is the part that still fails one time in ten, even at OpenAI with 250 people on it. That is an organizational problem that no model fixes. It is also a reminder that these figures describe OpenAI’s own unusually well-resourced estate, not the typical enterprise.

The closing instruction, “don’t wait for us,” is the most honest line in the keynote. Lou has just described a productized defense factory that only a small handful of customers can get, so Matt’s point is that the pieces already exist: the models, the Codex Security plugin and CLI, and dev containers for reproducible agent environments. The architecture Lou describes is not proprietary magic. It is a VM for kernel-level isolation and monitoring, a dev container that packages tools and security hooks (a CrowdStrike Falcon sensor, Wiz), and an agent with skills specific to your organization. A competent platform team could build a first version in weeks. The organizations that come out of this window in good shape will be the ones that treated it as an engineering project, not a vendor rollout.

Key Takeaways

OpenAI defines the “defender’s window” as the gap between its frontier cyber capabilities and the fast-improving open weights models behind them. The window is open now and will not stay open.
OpenAI’s EMEA general manager says cyber security went from absent to the opening topic in customer conversations within months. Nearly every meeting in the past two weeks started with it.
Adoption figures cited include more than 1 billion weekly users, and a German SMB, Stadler, running 145 agents alongside 650 employees for a 30 to 40% efficiency gain.
OpenAI says it grew its safety team, invested more compute in safety, and paused its most recent training runs for a couple of weeks in early August.
An open letter calling for a collective, ecosystem-wide response to AI-era cyber risk was signed by hundreds of organizations. Matt puts the count at 500.
OpenAI frames defense as an ecosystem play: company leadership making cyber the top priority, technology partners like Darktrace and Check Point, governments as accelerators, and OpenAI’s models.
OpenAI announced work with Ukraine on cyber defense, citing 6,000 attacks in the last year. ENISA, the EU cyber agency, reported finding unexpected vulnerabilities with OpenAI’s models.
A $1 billion fund subsidizes Daybreak access so hospitals, utilities, nonprofits and open source maintainers are not priced out of defense.
Matt opens with the Thames Barrier as a metaphor: infrastructure that protects a city for decades because someone takes responsibility for it.
OpenAI’s models helped find a 23-year-old flaw in OpenBSD and MikroTik vulnerabilities affecting releases back to 2013.
Findings are not the goal. Every finding triggers validation, deduplication and risk-acceptance checks, and only verified fixes actually protect anyone.
A government Cyber Shield initiative aims to use agents to find vulnerabilities and move toward automated remediation across critical infrastructure, in effect a national defense factory. Matt says the UK government is also pursuing this.
OpenAI’s position is that every organization needs its own defense factory, and that “their security is our security” for under-resourced defenders.
GPT-6 Astra is OpenAI’s most intelligent model, strong at software engineering and computer use, and trained specifically to find more vulnerabilities, including zero days.
On Exploit Gym, which only counts a working exploit (a crash is not enough), GPT-5.6 Sol completed about 30% of challenges. Astra completed about 40% more with far fewer output tokens.
OpenAI’s models, working with its researchers, found two unknown bugs in Chrome’s JavaScript engine and chained them into an exploit. Google shipped a fix.
Patch the Planet, run with Trail of Bits, funds researchers to use OpenAI’s models on open source projects like Python, curl and Go. It merged 37 patches in its first week, and the aiohttp maintainers fixed eight reported issues within hours.
Astra is OpenAI’s first model to reach the “cyber critical” threshold.
Safeguards are layered: refusal training, abuse detection and blocking, tighter limits on high-risk accounts, and monitors that watch the model’s reasoning and actions.
In a scope test with an exploitable out-of-scope shortcut, Sol without production safeguards took the shortcut about 48% of the time, and Astra never did.
Cyber capability is built by adding specialist training (vulnerability understanding, exploit development, result verification) on top of the frontier coding and reasoning models.
Daybreak Red is the highest access tier, for approved teams doing advanced red teaming and weaponized exploit development, such as turning crashes into exploits or chaining weaknesses.
Codex Security Red is a new managed penetration testing product. You define scope and rules of engagement in Codex, agents run in OpenAI-hosted isolated sandboxes, and a guardian agent reviews their outbound traffic.
Daybreak Blue is the starting point for most defenders: general-purpose frontier models (GPT-6 Sol, Luna, and soon Astra) with safeguards tuned for authorized code review, alert triage, vulnerability finding and patching.
The Codex Security demo runs a full scan on the Ladybird browser, reviewing about 28,000 files to build a threat model, surface candidate vulnerabilities, and validate them.
For a first scan, Vanessa recommends a full-codebase scan at high or extra-high reasoning on the most capable frontier model available.
Context is the differentiator. Attack vectors, areas of focus, compensating controls, business logic and your definition of fraud can all be seeded into a scan.
A security.md file works like an AGENTS.md for security. It gives repo-level context on threats, trust boundaries and priorities to every future scan.
A fix-finding skill generates a patch that can be applied locally and then verified to confirm the vulnerability is gone.
Sub-agents can patch findings in parallel, group them, open Jira tickets and draft GitHub PRs, and notify the right engineers on Slack, so the person who scans and the person who fixes can be different people.
At scale, the Codex Security CLI and SDK run bulk scans with configurable workers across a CSV of repositories, and plug into CI to catch vulnerable dependencies and fail checks on risky PRs. Vanessa says the tooling is open source.
OpenAI called an internal “code red” and pulled 250 people from engineering, security and research into a cross-functional team to build its first defense factory.
The defense factory loop is inventory, discovery, dynamic validation, ownership assignment, and verified remediation.
Existing security tools stay in place. What is new is agents, organization-specific skills, and isolated environments where agents can run the application and iterate.
The reference architecture runs inside your network, puts each agent in a VM for isolation and kernel-level monitoring, and uses a dev container for reproducible dependencies and security hooks such as a Falcon sensor or Wiz.
OpenAI’s internal results: a false positive rate under 1% after dynamic validation (Lou says 50 to 60% is common elsewhere), about 90% correct ownership assignment, and a fix rollback rate under 1%.
OpenAI is productizing the defense factory with a small group of early customers, with wider rollout over the coming weeks and months and more announcements expected around DevDay.
Matt’s practical next steps: apply for Daybreak, start with the Codex Security plugin on one repo, scale with the CLI and SDK in CI, and adopt dev containers for reproducible agent environments.
OpenAI plans to extend the work through a Daybreak Defense Network of training and implementation partners, and to move beyond prevention into investigation, response and security operations.

Detailed Summary

Opening: Trust, Safety and Why Everyone Showed Up

OpenAI’s general manager for Europe, the Middle East and Africa opens by placing the event in a moment of fast AI progress. They cite the recent solution of a Navier-Stokes mathematics problem, the release of GPT-6 Astra, more than a billion weekly users, and enterprise examples like Stadler’s 145 agents. With that capability comes the question of trust. OpenAI says it has expanded its safety team, invested in safety compute, and paused its latest training runs in early August. The speaker notes that six months ago no customer led with cyber, and now every one does. That is why 150 invitations produced 150 attendees. The defender’s window is framed as an ecosystem problem needing company leaders, technology partners, governments and OpenAI together, with Ukraine, ENISA and a $1 billion fund as early examples.

The Defender’s Window and the Case for Fixes Over Findings

Matt, OpenAI’s head of engineering for cyber, opens with the Thames Barrier: a piece of infrastructure that has protected London for more than 40 years because someone owns it. This summer OpenAI saw its frontier models finding weaknesses that had gone unnoticed for decades while broadly available models caught up, so it pulled its security, applied engineering and research teams together to harden its own systems. That became the defense factory. Matt’s central point is that findings are cheap and fixes are what count. Every finding kicks off validation, deduplication and risk review, and the capabilities that surface bugs also make them easier to exploit. He points to the Cyber Shield initiative and the UK government as national versions of the idea, and presents Daybreak, Codex Security and the $1 billion fund as the pieces that make it possible for organizations without OpenAI’s resources.

GPT-6 Astra: Capability, Efficiency and Real-World Results

OpenAI’s EMEA cyber go-to-market lead presents GPT-6 Astra as a big step for everyday engineering and computer use, and a bigger one for cyber: more vulnerabilities found, zero days included, and stronger red teaming. The key evaluation is Exploit Gym, which requires a working exploit against targets such as Chrome’s JavaScript engine and the Linux kernel. Astra completes about 40% more challenges than GPT-5.6 Sol’s roughly 30% while using far fewer output tokens, which lets defenders run more thorough testing on the same budget. Real results include two chained bugs in Chrome’s JavaScript engine, reported to Google and fixed, and Patch the Planet with Trail of Bits, which funds researchers to harden Python, curl, Go and other widely used open source projects. That program merged 37 patches in its first week.

Safeguards, the Cyber Critical Threshold and Alignment

Astra is OpenAI’s first model to reach the cyber critical threshold, so the safeguards were strengthened to match. They include refusal training, abuse detection, tighter controls on high-risk accounts, better detection of attempts to bypass the safeguards, and monitors that watch the model’s reasoning and actions for moments when it strays from instructions. OpenAI reiterates that it paused frontier training to focus on monitoring and alignment, and that safety thresholds must be met before capability is pushed further. On alignment, the scope test gives the model a hard task with an out-of-scope target it could exploit as a shortcut. Sol without production safeguards did so in about 48% of cases. Astra did so in none.

Daybreak Red, Daybreak Blue and Codex Security Red

Cyber models are built by adding specialist training on vulnerabilities, exploit development and result verification on top of the frontier coding and reasoning models, then offered in two tiers. Daybreak Red gives approved teams specialist models for advanced red teaming and weaponized exploit development. Because giving an agent that much capability requires clear boundaries, OpenAI announced Codex Security Red, a managed penetration testing service. Teams define scope and rules of engagement in Codex. Investigation agents run in isolated, OpenAI-hosted sandboxes, their requests to your application pass through network controls and a guardian agent, and findings and evidence collect in a dashboard. Daybreak Blue is the default for most defenders, offering GPT-6 Sol, Luna and soon Astra with safeguards tuned for code review, alert triage and patch creation.

Live Demo: Codex Security on the Ladybird Browser

Vanessa, a cyber deployment engineer, runs Codex Security in the Codex desktop app against a local copy of Ladybird, the pre-alpha open source browser, which is now also part of Patch the Planet. She picks a full-codebase scan over a diff scan for the first run, sets high or extra-high reasoning, and stresses the context fields: attack vectors, focus areas, and enterprise context such as compensating controls, business logic and definitions of fraud. The scan builds a threat model from about 28,000 files, surfaces candidates, validates them, and reports a shared JavaScript bytecode cache vulnerability with its attack path, impact and likelihood. A fix-finding skill generates a patch, which is applied and verified. A security.md file is then generated and committed, so future scans inherit the repo’s security context.

Scaling Remediation: Sub-Agents, Tickets, PRs and the CLI

To go beyond one repo, Vanessa asks Codex to take the scan results and spawn sub-agents. Each one patches and validates a finding, groups related findings, opens Jira tickets and draft GitHub PRs, and notifies the right engineer on Slack. The PRs can be tuned to your CI pipeline so checks stay green before a human merges. The question she hears most from roughly a thousand customer meetings is scale: seven vulnerabilities in one repo is easy, 10,000 repos is not. The answer is the Codex Security CLI and SDK, which package the plugin’s composable skills for bulk scans with configurable workers across a repositories CSV, and for CI checks on dependency upgrades and new PRs.

Inside OpenAI’s Defense Factory

Lou, the field CTO for cyber, describes the internal code red: 250 people across engineering, security and research building a first version of continuous defense. The loop runs from inventory of the attack surface, to discovery with cyber models, to dynamic validation (duplicate? already tracked? reachable?), to ownership assignment through Slack, PagerDuty and source control, and finally to verified remediation. Existing tools stay in place. What is new is agents, organization-specific skills, and isolated environments where agents run the application itself. Each agent runs inside your network in a virtual machine, chosen over containers for stronger isolation and kernel-level monitoring of tool calls. On top of the VM sits a dev container built on Microsoft’s open specification for reproducible dependencies and security hooks. Results: under 1% false positives, about 90% correct ownership, and under 1% fix rollbacks. OpenAI is productizing this with a few early customers ahead of DevDay and further cyber announcements.

Closing: Don’t Wait

Matt returns to tie the pieces together: models provide capability, Codex and development tools put it to work, and security workflows give a starting point. His main lesson is not to wait for OpenAI’s product. He gives four steps: apply for Daybreak, start with the Codex Security plugin on one repository, scale through CI with the CLI and SDK, and package agent environments in dev containers for reproducible testing and clear ownership. OpenAI plans to go beyond prevention into investigation, response and security operations, and to bring in training and implementation partners through the Daybreak Defense Network. He closes on the hope that the industry will look back on this window as the moment it came together and made the world more secure.

Notable Quotes

“Six months ago the messages were not around cyber. Six days ago everybody started the conversation with cyber security concerns. Everybody.”
OpenAI’s EMEA general manager, on how quickly customer priorities shifted

“Fixes are what we want not findings in order to protect our institutions.”
Matt, head of engineering for cyber at OpenAI, on the real bottleneck in vulnerability management

“We can’t assume we’re going to stay ahead, but we do know we’re ahead for now.”
Matt, on the temporary nature of the defender’s advantage

“The defenders window is open. It’s not going to stay open for long, but it’s open right now, and we need to make it count.”
Matt, framing the thesis of the keynote

“As Sam has said previously, we shouldn’t be taking risks on behalf of humanity. People need to remain in control.”
OpenAI’s EMEA cyber go-to-market lead, introducing the safeguards on GPT-6 Astra

“We’re not interested in just having a raw dump of vulnerabilities. Our goal is to ultimately remediate and burn down risk.”
Vanessa, cyber deployment engineer, during the Codex Security demo

“It’s very very easy to do this for one repo when you have seven vulnerabilities but how do you do this when you have 10,000 repos?”
Vanessa, introducing the Codex Security CLI and SDK

“Across our dynamic validation we managed to get our false positive rate down below 1%. Which for a lot of organizations this number is vastly higher.”
Lou, field CTO for cyber, reporting results from OpenAI’s internal defense factory

“Don’t wait for us. All the pieces are here. We don’t have time.”
Matt, urging security teams to build their own defense factory now

Watch the full Defender’s Window keynote here.

Tag: EU cyber agency

OpenAI’s Defender’s Window Cyber Security Keynote: GPT-6 Astra, Daybreak Red and Blue, Codex Security Red, the $1 Billion Defense Fund, Patch the Planet, and How OpenAI Built Its Internal Defense Factory