OpenAI says Block is using Daybreak and Codex to accelerate security investigations and remediation while retaining human review of every result.
Block is using OpenAI technology, including Daybreak and Codex, to find vulnerabilities, tune threat detection, investigate incidents and prepare remediations. According to OpenAI, the company behind Square, Cash App and Afterpay has built a security system that assigns tasks to suitable models, supports human takeover and lets agents check one another’s work.
One reported workflow can replay a proposed detection change against seven months of production telemetry in under an hour. OpenAI says this replaces a largely manual process that required reviewing hundreds of historical cases. During a recent red-team exercise, Block also produced an automated proposed patch 18 minutes after receiving a high-level description of a vulnerability.
OpenAI reports that automated triage increased Block’s triage throughput by 50%, while intelligence gathering and investigations also rose by 50%. The system reportedly performs about 1,100 analyst-hours of investigative work each quarter and returns roughly 600 hours previously spent triaging false positives. These are operational results from Block’s implementation, not controlled comparative research or promised outcomes for other organizations.
Daybreak is designed to connect evidence across systems and reconstruct complete compromise paths rather than assess vulnerabilities in isolation. In one example, it linked an apparently minor laptop-policy alert with endpoint evidence and identity logs, revealing a broader campaign. In another, it used limited information about an internal system to map an attack involving SQL injection, privilege escalation, credential enumeration and movement into other systems.
OpenAI says the second attack path took approximately two hours to assemble, compared with several days of human red-team work under the company’s estimate. The example illustrates how the system can combine findings into an investigation sequence, but the source does not present an independent benchmark or a controlled comparison.
People remain responsible for final decisions. A Block specialist validates every result, confirms exploitability, guides remediation, verifies the fix and deploys code changes. OpenAI acknowledges that agents do not possess an organization’s complete context or understand all the reasoning behind earlier technical decisions. Block therefore evaluates the tools through internal benchmarks and operational performance, sends work for human review when appropriate and plans to expand their use in sensitive systems gradually.
The consequential feature is the structure of the workflow, not only its speed: proposed changes can be tested against historical telemetry, agents can review one another’s output and disputed or final actions can be escalated to people. That design may reduce the risk of automatically applying a flawed remediation, although its effectiveness still depends on Block’s internal data, evaluation methods and human controls.
| Scenario | Reported result | Context |
|---|---|---|
| Testing a detection change | Seven months of telemetry in under one hour | Previously required a largely manual review of hundreds of cases |
| Preparing a remediation | 18 minutes after the vulnerability description | Result reported from a red-team exercise |
| Initial alert triage | 50% increase in throughput | Block operational metric |
| Automated investigations | About 1,100 analyst-hours per quarter | Result from this implementation, not a controlled comparison |
Sources
Originally published by AI Feed: Block Uses Daybreak and Codex to Automate Security Work.
Top comments (0)