OpenAI Unveils Defense Factory, a Continuous AI Security Operations Model

OpenAI has publicly detailed Defense Factory, an agent-first, continuous security program designed to identify, validate, and remediate vulnerabilities across its own systems. The initiative originated from an internal security sprint that mobilized over 250 people across hundreds of service areas. Rather than treating security as a periodic review, OpenAI frames it as a closed-loop cycle with five linked stages: inventory, discovery, validation, ownership assignment, and remediation verification. The program features a dedicated architecture that separates control and data planes to support isolated, reproducible development environments. OpenAI intends to publish workflows and findings on an ongoing basis, positioning the model as a scalable reference for organizations deploying AI at scale.