Block’s OpenAI AI Cuts Security Fix Time to 2 Hours [2026]

• Sofia Lindström
• October 15, 2026
• AI & Machine Learning

Block, the parent company of Square, Cash App, and Afterpay, confirmed on October 14, 2026, that its security team has built an AI-driven defense system on top of OpenAI’s infrastructure, one that can chain together a simulated multi-stage attack, from SQL injection through privilege escalation to a full system pivot, in about two hours. The disclosure, made jointly by OpenAI and Block, marks one of the clearest public examples yet of a major financial technology company handing meaningful parts of vulnerability discovery, detection, and response over to autonomous AI agents, with a human still signing off on every deployed fix.

The announcement lands at a moment when fintech security teams are under growing pressure from both sides: attackers are using generative AI to write exploit code faster, while defenders are struggling to keep pace with sprawling cloud infrastructure and legacy systems. Block’s approach, built around OpenAI’s Defense Factory program and a model-routing harness called Daybreak, is being framed by both companies as a template for how enterprise security teams might operate going forward.

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

What Block and OpenAI Actually Announced

According to the joint disclosure, Block’s security organization now relies on the OpenAI Defense Factory for core parts of its vulnerability workflow: finding weaknesses in its codebase, detecting active threats, and responding to incidents. The centerpiece of that workflow is a system Block calls Daybreak, described as a security harness that OpenAI and Block built together. Daybreak does not rely on a single model. Instead, it routes individual tasks to whichever OpenAI system is best suited for that job, pulling in different models depending on whether the task is static code analysis, exploit simulation, or natural-language triage of an incident report.

Two design choices stand out in how Block has built this system. First, the harness includes an explicit mechanism for human takeover at any point, meaning a Block engineer can interrupt an automated workflow and take direct control rather than waiting for the AI to finish its task. Second, it supports agent-to-agent verification, where one AI agent checks the work of another before a result is treated as trustworthy enough to act on. That second layer is notable because it addresses one of the most common criticisms of agentic AI security tools: that a single model can hallucinate a vulnerability that does not exist, or miss one that does, with no independent check.

Block’s three consumer-facing brands, Square for merchant payments, Cash App for peer-to-peer transfers, and Afterpay for buy-now-pay-later financing, all sit behind the same security organization, which means the Daybreak harness is not a narrow experiment confined to one product line. It touches infrastructure that handles payment processing and personal financial data at scale, which is part of why the companies chose to publicize the arrangement rather than keep it as an internal engineering detail.

Inside OpenAI’s Defense Factory

The Defense Factory is OpenAI’s umbrella effort to apply its models directly to cybersecurity defense, and Block is one of the named participants using it in production rather than in a pilot sandbox. The program’s stated emphasis, according to OpenAI’s own framing, is on producing validated fixes rather than simply generating lists of potential vulnerabilities, a distinction that matters a great deal to security teams who are already drowning in unprioritized scanner output. A vulnerability report that nobody has time to triage is close to worthless; a verified patch that has already been tested against exploitability is immediately actionable.

That emphasis shows up directly in how Block describes its own workflow. The process, as described by Block’s security leadership, follows a loop: propose a patch, confirm that the underlying flaw is actually exploitable, then verify that the patch closes the hole, all with a human in the loop guiding the process and making the final call on deployment. That loop structure is deliberately different from older vulnerability management tools, which tend to stop at detection and leave remediation entirely to human engineers working through a backlog.

James Nettesheim, Block’s Chief Information Security Officer, described the shift in incentives this way: “You propose a patch, you confirm exploitability, and then you verify that you have fixed it, with a human in the loop guiding it and deploying the code changes.” The framing is significant because it keeps a named, accountable human at the point of deployment, even as the discovery and validation steps become increasingly automated.

The Two-Hour Attack Chain: What Daybreak Actually Did

The most concrete technical detail to emerge from the announcement is a specific internal test. In that exercise, Daybreak independently chained together a multi-stage attack path: it started with a SQL injection vulnerability, used that as a foothold to escalate privileges, established persistence inside the simulated environment, enumerated credentials it found along the way, and then pivoted to other connected systems. Block and OpenAI say the entire chain, from initial injection to lateral movement into additional systems, took the AI system about two hours to complete.

That timeline matters because it mirrors, in compressed form, exactly the kind of attack path a skilled human red team would spend days mapping out manually. Chaining several distinct vulnerability classes together, rather than treating each one as an isolated finding, is the hard part of offensive security work, since it requires understanding how a foothold in one system creates an opportunity in another. Having an AI system demonstrate that it can walk that chain in roughly two hours is being used internally, and now publicly, as the proof point that a defensive AI model trained to think the way an attacker does can actually surface the kinds of compound risks that single-vulnerability scanners routinely miss.

It’s worth being precise about what this test does and does not show. It demonstrates that the Daybreak harness can replicate a known attack pattern inside a controlled test. It does not, on the evidence disclosed so far, establish a general claim that AI-generated patches now ship in minutes rather than hours, nor does it reveal how many such chains Daybreak has found that a human team had previously missed. Those are the kinds of follow-up numbers that outside security researchers will likely be pushing Block and OpenAI to disclose in the coming months.

Stage	Action Daybreak Performed	Why It Matters
1	Identified a SQL injection vulnerability	Initial entry point into the simulated environment
2	Escalated privileges from the injection point	Converts a data-layer bug into broader system access
3	Established a persistent foothold	Mirrors how real intrusions maintain access over time
4	Enumerated available credentials	Mimics the reconnaissance step attackers use before moving laterally
5	Pivoted to other connected systems	Demonstrates compound, multi-system risk, not an isolated bug
Total elapsed time	Approximately two hours, start to finish, according to Block and OpenAI

Seven Months of Telemetry, Replayed in Under an Hour

Beyond the attack-chain test, Block disclosed a second capability that may ultimately prove more operationally important than the headline-grabbing exploit chain: the ability to replay a proposed detection rule change against seven months of accumulated production telemetry in under an hour. For any security team that has shipped a new detection rule only to watch it flood the team with false positives, or worse, silently miss the exact pattern it was supposed to catch, this kind of rapid historical backtesting is a meaningful operational upgrade.

Traditionally, validating a new detection rule against months of historical log data is a slow, resource-intensive process, often requiring dedicated data engineering support just to query and format the telemetry correctly. Compressing that validation window down to under an hour means Block’s security engineers can iterate on detection logic far more aggressively, testing multiple candidate rules against real historical traffic before any of them ever reaches a production alerting pipeline. That reduces the two most common failure modes of detection engineering: alert fatigue from overly broad rules, and blind spots from overly narrow ones.

This telemetry-replay capability also reinforces why Block frames Daybreak as a harness rather than a single chatbot-style assistant. Querying and reasoning over seven months of production data at that speed requires routing the task to a model and infrastructure configuration suited specifically for large-scale pattern matching, which is different from the reasoning needed to chain together an exploit path. The harness architecture, with its task-routing logic, is what allows both jobs to run inside the same overall system.

Human-in-the-Loop: Why Block Isn’t Handing Over the Keys

For an announcement centered on autonomous AI agents, the most consistent theme running through Block’s public statements is how deliberately they have kept a human at the center of the loop. Nettesheim’s description of the propose-confirm-verify cycle explicitly ends with “a human in the loop guiding it and deploying the code changes,” not an AI agent pushing code directly to production on its own authority. That is a meaningfully conservative design choice for a company that processes payment data at the scale Block does.

Nettesheim elaborated on the broader strategic logic behind this approach, framing it as part of a shift in who holds the speed advantage in cybersecurity: “AI is compressing the time from human intent to action. For a while, it was assumed that there was an attacker advantage since they’re faster and more nimble. But with things like Daybreak and the advancements in OpenAI’s tooling, defenders are able to fight fire with fire and keep up with the rapid pace of AI adoption,” he said, in comments included in OpenAI’s published account of the partnership. Block has also published its own description of the arrangement on its corporate blog, framing AI as actively reshaping how the company protects customers, language that closely mirrors OpenAI’s own framing of the Defense Factory’s goals.

The human-takeover mechanism built into the Daybreak harness isn’t just a safety feature bolted on for the press release. It reflects a practical reality: an AI agent that autonomously enumerates credentials and pivots across systems, even inside a test environment, is performing actions that would be alarming if it did them unsupervised in live production. Keeping a documented, interruptible human checkpoint at every stage is how Block appears to be threading the needle between genuinely faster security operations and the kind of uncontrolled automation that could itself become a liability.

What Security Leaders Are Saying

OpenAI’s own leadership has described the Defense Factory initiative in terms that go beyond any single customer deployment. Thibault Sottiaux, OpenAI’s Head of Core Products and Platform, described the internal urgency behind the program: “We are strengthening our defenses with the urgency of an incident. This is an all-hands effort that takes precedence over everything except critical business operations. We will carry that same urgency beyond the sprint as we continue to test and strengthen our defenses.”

Other voices associated with the Defense Factory program have framed the stakes in terms of a narrowing advantage for defenders. One OpenAI speaker described what the team internally calls the “defender’s window,” the gap between the capabilities of the frontier models a company like OpenAI is shipping and the capabilities available through fast-advancing open-weight models that attackers can run themselves without restriction. The implicit argument is that this window won’t stay open indefinitely, which is part of why OpenAI is pushing customers like Block to operationalize AI-driven defense now rather than treating it as a future roadmap item.

That same emphasis on outcomes over raw findings showed up in a separate comment from the Defense Factory team, summarized succinctly as wanting fixes rather than findings, a philosophy that lines up directly with how Block describes its own propose-confirm-verify loop. Security technology commentators tracking the space have echoed that framing, arguing that the real shift isn’t faster detection in isolation, but compressing the entire gap between vulnerability, detection, remediation, and defense into a single continuous workflow, which changes the operating model for cybersecurity teams rather than simply giving them a faster scanner.

Market Impact: Fintech Security Spending Under Pressure

Block’s disclosure arrives at a moment when fintech companies broadly are under scrutiny for how they protect customer financial data. Cash App itself has been the subject of a separate, unrelated $15 million breach settlement now paying out to affected users this month, a reminder that Block’s consumer brands remain high-value targets regardless of what new AI tooling the security team deploys internally. That overlapping timeline, a legacy breach settlement paying out in the same month the company announces an AI-driven security overhaul, is likely to draw comparisons from both regulators and customers assessing whether the new system would have prevented the old incident.

For the broader cybersecurity vendor landscape, Block’s public embrace of an OpenAI-built harness adds pressure on established security categories to show their own AI roadmaps are keeping pace. Identity and privileged access management vendors, the space covered in the ongoing competitive rivalry between CyberArk, BeyondTrust, and Delinea, have already been racing to add AI-assisted anomaly detection to credential monitoring. Endpoint detection vendors face a similar dynamic, with the three-way market share battle between CrowdStrike, SentinelOne, and Microsoft Defender increasingly turning on which platform can demonstrate agentic remediation rather than just faster alerting.

Coverage of the broader AI-cybersecurity beat, including ongoing tracking of how AI labs and enterprises are applying models to defense work, suggests Block’s disclosure is part of a wider wave of companies moving AI security tooling out of pilot programs and into production systems this year. Vulnerability management providers are feeling comparable pressure. The three-way scanner comparison covered in Tenable versus Qualys versus Rapid7 highlighted how patch volume has already overwhelmed many security teams’ manual triage capacity; a system like Daybreak that can validate exploitability and propose a fix directly addresses that exact bottleneck. If Block’s results hold up under outside scrutiny, expect vulnerability management vendors to accelerate their own AI-assisted remediation features rather than stopping at detection and scoring.

Historical Context: From SOAR to Agentic Defense

Security operations automation has gone through several distinct phases. The earlier generation of security orchestration, automation, and response tools, generally known by the SOAR acronym, automated playbooks for routine, well-understood incidents but still required a human analyst to write every rule and handle anything novel. The next wave brought AI copilots into the security operations center, tools that could summarize alerts and suggest next steps in natural language, but which still left the actual investigation and remediation work to a human.

What Block and OpenAI are describing with Daybreak represents a further step along that same trajectory: an AI system that doesn’t just summarize or suggest, but actively performs the technical work of finding an exploitable chain, proposing a specific patch, and confirming that the patch closes the hole, with a human positioned at the final decision point rather than at every intermediate step. That shift, from AI as an assistant that speeds up a human’s work to AI as an agent that performs bounded tasks independently and hands off a validated result, is the broader industry pattern that Block’s disclosure fits into. Other AI-adjacent security incidents this year have underscored both the promise and the risk of that shift: OpenAI’s own tools reportedly helped identify an insider threat inside the company’s offices within nine days, while separate reporting on credential exposure across AI agent infrastructure has shown how quickly new AI tooling can introduce its own attack surface if deployed carelessly.

Competitive Comparison: How Block’s Approach Stacks Up

It is difficult to directly benchmark Block’s Daybreak harness against named competitor systems, since most enterprise security teams do not publish specific performance figures for their internal AI tooling. What can be compared is the structural approach: how much of the vulnerability lifecycle is automated, and where the human checkpoint sits.

Approach	Detection	Validation of Exploitability	Patch Proposal	Human Checkpoint
Traditional manual security review	Human-led, scanner-assisted	Manual, case by case	Fully manual	At every step
Legacy SOAR automation	Rule-based, automated for known patterns	Manual for novel cases	Manual	At every step beyond pre-approved playbooks
AI copilot-assisted SOC	AI-summarized, human-reviewed	Human-led with AI suggestions	Human-drafted, AI-assisted	Throughout the process
Block’s OpenAI-powered Daybreak harness	AI agent-led, chains multi-stage attack paths	AI-confirmed before a fix is proposed	AI-proposed, AI-verified against the original flaw	Final deployment decision only, per Block’s public description

That final row is the crux of what makes Block’s disclosure notable. Moving the human checkpoint from “every step” down to “final deployment decision” is a meaningful compression of the security workflow, assuming the intermediate AI-driven steps hold up to independent scrutiny over time. It is also exactly the kind of structural change that cloud-native application protection platforms, a category covered in the ongoing three-way competition between Wiz, Orca, and Prisma Cloud, will likely need to match if they want to retain large financial services customers who are now benchmarking vendor platforms against what an in-house team built with OpenAI’s tooling.

Risks and Open Questions

Several questions remain unanswered by the current disclosure, and they matter for anyone evaluating whether to follow Block’s lead. First, neither company has published a false-positive or false-negative rate for the Daybreak harness, so it’s not yet possible to independently assess how often the AI-proposed patches are correct versus how often a human reviewer has to reject or substantially rework them. Second, the two-hour attack-chain test was run internally, which means outside security researchers have not yet had the opportunity to red-team the red-teaming tool itself, a step that will likely be necessary before other large financial institutions adopt a similar architecture with full confidence.

There is also a structural dependency worth flagging: Block’s security posture is now meaningfully tied to the availability and reliability of OpenAI’s infrastructure. Any future outage, API change, or policy shift on OpenAI’s end has a direct line into Block’s detection and remediation capability, a form of vendor concentration risk that is different from, but related to, the kinds of third-party risk fintech regulators already scrutinize closely. Given that AI labs themselves have faced their own insider-risk incidents this year, the question of how much operational security trust any single enterprise should place in a single AI vendor is not purely theoretical.

What Comes Next: Five Predictions

• Other large fintech and payments companies will likely disclose similar partnerships with OpenAI’s Defense Factory or a comparable program from a rival AI lab within the next two to three quarters, following Block’s lead in going public rather than keeping the arrangement private.
• Established security vendors in the EDR, SIEM, and vulnerability management categories will accelerate marketing and product announcements around “agentic” or “autonomous” remediation features to avoid losing enterprise deals to custom in-house builds like Block’s.
• Expect independent security researchers and red teams to request, or attempt, external testing of Daybreak-style harnesses, pushing companies like Block toward more detailed public performance disclosures than the single two-hour test case released so far.
• Regulators overseeing financial institutions will likely start asking more specific questions about human-in-the-loop requirements for AI-driven security tooling, given how directly these systems now touch payment infrastructure and customer data.
• The “defender’s window” that OpenAI’s own team has described as a temporary advantage will remain a live talking point throughout 2027, as open-weight models continue narrowing the capability gap that currently favors well-resourced defenders like Block.

Why This Matters Beyond Block

Block is a large company, but it is not uniquely large among OpenAI’s enterprise customer base, and that is precisely why this disclosure carries weight beyond its own balance sheet. Independent trackers that monitor enterprise AI rollouts, including dedicated company-level adoption data on Block’s AI initiatives, now treat this kind of production security deployment as a bellwether for how far regulated industries are willing to go in handing operational tasks to AI agents. The company is using its scale, Square’s merchant network, Cash App’s consumer base, and Afterpay’s lending book, as a proving ground for an approach that OpenAI clearly wants to sell more broadly. If the Daybreak harness continues to perform at the level described in this initial disclosure, it becomes a reference case that OpenAI’s sales and partnership teams will point to when pitching the Defense Factory to other regulated industries, including healthcare, insurance, and other segments of banking that have historically been slower to adopt AI-driven infrastructure changes.

The timing also matters. Security teams across the industry are contending with a widening gap between the volume of code being shipped, much of it now AI-assisted itself, and the available human capacity to review it for security flaws before it reaches production. A harness that can replay seven months of telemetry in under an hour and chain together a realistic attack path in about two hours isn’t just a faster version of existing tools; it’s a direct response to that capacity gap, and one that other large engineering organizations are watching closely as they weigh their own AI security investments heading into 2027.

Frequently Asked Questions

What is Block’s OpenAI Defense Factory partnership?
Block’s security team uses OpenAI’s Defense Factory program for vulnerability discovery, threat detection, and incident response, built around a harness called Daybreak that routes tasks to different OpenAI models.

What is OpenAI Daybreak?
Daybreak is the security harness Block and OpenAI built together. It routes individual security tasks to the appropriate OpenAI model, includes a mechanism for human takeover at any point, and supports agent-to-agent verification of results.

How fast can Block test a new security detection rule?
Block says it can replay a proposed detection change against seven months of production telemetry in under an hour using the Daybreak harness, a process that would traditionally take significantly longer with manual data analysis.

Did Daybreak actually simulate a real attack?
In an internal test, Daybreak chained together a simulated attack path involving SQL injection, privilege escalation, establishing a foothold, enumerating credentials, and pivoting to other systems, completing the full chain in about two hours.

Does the AI deploy security fixes on its own, without human approval?
No. According to Block’s Chief Information Security Officer James Nettesheim, a human remains in the loop guiding the process and making the final decision to deploy any code changes, even though the patch proposal and verification steps are AI-driven.

Which Block brands are covered by this security system?
Block’s security organization, which now uses the Daybreak harness, covers the company as a whole, including its Square, Cash App, and Afterpay consumer and merchant products.

Is Block the only company using OpenAI’s Defense Factory?
Block is a named, public example of a company operationalizing the Defense Factory program, but the current disclosure does not establish how many other companies are using the same or a similar system.

What are the main risks of this kind of AI-driven security automation?
Open questions include the lack of published false-positive and false-negative rates, the absence of independent outside testing of the Daybreak harness, and the fact that Block’s security capability is now more directly tied to the reliability of a single AI vendor’s infrastructure.