OpenAI details its AI-driven 'Defense Factory' for vulnerability hunting

OpenAI says it mobilized more than 250 people, combining its security, applied AI and research teams, to run a company-wide vulnerability sweep across hundreds of internal systems using its newest cyber-focused models. It published the results and the underlying architecture in a detailed report, framed as a continuous five-stage loop rather than a one-time audit: agents inventory systems, hunt for vulnerabilities, validate them dynamically against the real environment, assign ownership, and verify that a proposed fix actually closes the issue.

The published numbers are OpenAI's own: 90.6% of flagged issues were accepted by the team assigned to own them, 37% of raw findings turned out to be duplicates, dynamic validation reproduced 19.5% of findings against the live environment with a 0.81% false-positive rate, and only 0.53% of agent-generated fixes had to be rolled back. Agents closed 53 urgent or high-priority issues on the first day. These are self-reported internal metrics from one company's own systems, not an independent audit of the approach.

“We mobilized 250+ people to strengthen our defenses across hundreds of systems.”

“Our latest cyber models helped us find and fix vulnerabilities we might never have discovered otherwise.”

“We're sharing what we learned, the architecture, and a practical playbook so you can build your own Defense Factory: a continuous loop where AI agents find vulnerabilities, validate them, and verify that fixes work.”