OpenAI Daybreak at Block: AI Security Results, 50% Triage Throughput Gain and 18-Minute Patch Proposals
OpenAI published a customer story on October 14, 2026 describing how Block — the company behind Square, Cash App, and Afterpay — uses OpenAI's security tooling, including OpenAI Daybreak and the OpenAI Defense Factory, to automate vulnerability discovery, detection, and response. The headline claim is speed: work that previously took days or weeks now takes hours, with Block reporting a 50% boost to triage throughput, a 50% increase in intelligence gathering and investigations, and roughly 1,100 analyst-hours of investigation completed per quarter.
The post is a customer case study rather than a technical paper or a product launch. It contains no model version numbers, no benchmark methodology, and no independent verification of the reported figures — all numbers come from Block's own security team as described by OpenAI.
What OpenAI announced
OpenAI published a customer story about Block's security organization, framed around two named OpenAI offerings: the OpenAI Defense Factory and OpenAI Daybreak. The Defense Factory is described as the setting in which AI handles vulnerability discovery, detection, and response at a scale no human team could keep up with. Daybreak is the model the Block team builds on top of.
Block's Chief Information Security Officer, James Nettesheim, frames the shift as a rebalancing of attacker-versus-defender advantage:
"AI is compressing the time from human intent to action. For a while, it was assumed that there was an attacker advantage since they're faster and more nimble. But with things like Daybreak and the advancements in OpenAI's tooling, defenders are able to fight fire with fire and keep up with the rapid pace of AI adoption."
How Block describes working with the models
Block's security team characterizes the AI as a scalable teammate rather than conventional automation. Nettesheim contrasts the two directly:
"What it's really centered on is having a new teammate that you can scale with. It's not like a more traditional automation where you had to go step by step. You can prompt it with a fairly bespoke, ambiguous problem and work through it together."
According to the post, tasks such as reviewing a software bug or parsing a log previously took days or weeks and now complete in a fraction of the time, with a human validating every result.
Results at a glance
OpenAI lists the following figures, attributed to Block's security team:
| Metric | Reported result |
|---|---|
| Replaying a proposed detection change against seven months of telemetry | Less than one hour |
| High-level vulnerability to automated proposed patch (recent red team exercises) | 18 minutes |
| False-positive triage time returned to the team | Roughly 600 analyst-hours per quarter |
| Investigation work completed | Approximately 1,100 analyst-hours per quarter |
| Triage throughput | 50% boost |
| Intelligence gathering and investigations | 50% increase |
Detection tuning: replaying changes against seven months of telemetry
Block's detection-tuning workflow stores raw query evidence for every investigation. That stored evidence lets the team replay a proposed detection change against seven months of production telemetry in under an hour. The post states that this work previously required requerying hundreds of old cases by hand and often did not happen at all because it was so time-consuming.
Vulnerability discovery: chaining attacks into full compromise paths
Traditional scanning tools flag a single vulnerability in isolation. According to the post, Daybreak instead helps hypothesize about attack patterns and chain a series of attacks into a full end-to-end compromise path, surfacing vulnerabilities that may have existed for years.
One example described in the post: an alert on a single laptop looked like a minor policy issue on its own. During peer review, the model followed an indicator that appeared only incidentally in the evidence, joined it against Block's identity logs, and surfaced a much larger set of issues. Nettesheim's summary of that case:
"One routine endpoint alert became a campaign takedown. No single tool makes that join. The signal only exists across two products' logs."
Red team results: two hours versus several days
In a recent red team exercise, the model was given a few hints about an internal system and chained together a full attack path — SQL injection, privilege escalation, a foothold, credential enumeration, and a pivot to other systems — in about two hours. The post states this would typically take a human red teamer several days. It also reports that in recent red team exercises, the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes.
Remediation keeps a human in the loop
Finding vulnerabilities is only as useful as the ability to fix them. Nettesheim describes a consistent process applied to every finding: locate where the issue lives in the code and identify who owns it, then move to remediation. In his words, the team will "propose a patch, you confirm exploitability, and then you verify that you have fixed it, with a human in the loop guiding it and deploying the code changes."
The post is explicit about why humans remain central: agents do not carry an organization's context or the reasoning behind previous decisions. A human supplies that context and strategy, and Block's team provides a human layer of review. Nettesheim describes a graduated approach to autonomy:
"We'll slowly ladder up the risk level to use it for more sensitive systems."
Model routing and the security harness
Block reports it has become more selective about which model handles which job. Nettesheim notes the change in practice:
"We used to use the latest model, but you don't need to do that anymore. It's been a learning experience to choose different models for different tasks."
Block's security harness is built on top of Daybreak to route tasks to the appropriate model. The harness includes hooks for humans to take over tasks and for agents to verify each other's work. The team says it continually evaluates these systems against internal benchmarks and real-world performance, adjusting its approach when needed — including routing work to human review when that is the responsible path.
What's next
Detection and response work alone has returned roughly 600 analyst-hours per quarter that previously went to triaging false positives. Block says it now spends that time on deeper investigations and on building more automation responsibly.
Looking forward, Nettesheim points to reducing the number of vulnerabilities introduced in the first place, which would let security teams spend less time patching and more time on preventative, strategic work. He frames the broader implication as access:
"OpenAI is shifting the advantage to defenders by putting these advanced capabilities in everyone's hands. It's typically only been in very high-profile technology companies and government hands. But everyone, including critical infrastructure, schools, small businesses, can now start utilizing this technology to defend their networks."
What the source does not say
OpenAI's post does not name specific model versions behind Daybreak, does not describe the Defense Factory's architecture or pricing, and does not publish the internal benchmarks Block references. The performance figures are self-reported by Block and presented without an external audit, so they should be read as a vendor-published customer account rather than an independently measured evaluation.