Block Just Handed Its Security Playbook to AI Agents. Two Hours Later, They Had Mapped a Full Attack Chain.

On October 14, Block, the fintech company behind Square, Cash App, and Afterpay, confirmed that its security team has handed core parts of vulnerability discovery, detection, and response to AI agents running on OpenAI's infrastructure. The disclosure, made jointly with OpenAI, is one of the clearest public examples yet of a major financial company running autonomous AI agents against production-grade security problems rather than keeping them in a sandbox.

The centerpiece is a system called Daybreak, built inside OpenAI's Defense Factory program. It is not a chatbot with a security plug-in. It is a harness that routes individual tasks to whichever OpenAI model is best suited for the job: one model for static code analysis, another for exploit simulation, another for natural-language triage of incident reports. Block says the arrangement compresses work that used to take weeks into hours, and the company is now publishing specifics to back that up.

The two-hour attack chain

The headline proof point is a red-team exercise. Given a few hints about an internal system, Daybreak chained together a full multi-stage attack path: it started with a SQL injection foothold, escalated privileges from the injection point, established persistence inside the simulated environment, enumerated the credentials it found along the way, and pivoted to other connected systems. The entire chain, from first injection to lateral movement, took about two hours. OpenAI's published account says a human red team would typically need several days to map out the same path.

The hard part of offensive security is not finding a single bug. It is showing how a foothold in one system becomes an opening in another. That compounding, multi-vulnerability reasoning is exactly what single-scanner tools miss, and it is what Daybreak demonstrated in the controlled test.

A human red team would spend days mapping an attack path. Daybreak walked the full chain in about two hours, inside a controlled test.

Precision matters here. The exercise shows Daybreak can replicate a known attack pattern in a controlled environment. It does not, on the evidence disclosed so far, establish that the system routinely finds novel chains humans would have missed, nor how many such chains it has found that a human team overlooked. Those are the numbers outside researchers will keep pushing for.

Seven months of telemetry, replayed in under an hour

The less flashy capability may prove more operationally important. Every investigation at Block stores its raw query evidence, so the team can replay a proposed detection-rule change against seven months of production telemetry in under an hour. Traditionally, validating a new detection rule against months of historical log data meant requerying hundreds of old cases by hand, work so slow and resource-intensive that it often simply never happened.

Compressing that validation window changes detection engineering. Engineers can test multiple candidate rules against real historical traffic before anything reaches the production alerting pipeline, attacking the two classic failure modes of detection: alert fatigue from overly broad rules, and silent blind spots from overly narrow ones.

The reported numbers are specific: roughly 600 analyst-hours per quarter handed back from false-positive triage, about 1,100 analyst-hours of investigation completed each quarter, a 50 percent boost in triage throughput, and a 50 percent increase in intelligence gathering and investigations. And the fix loop is tightening too: in recent exercises, the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes, with a human still guiding deployment.

The human keeps the keys

For an announcement centered on autonomous agents, the most consistent theme is how deliberately Block has kept a human at the center. The workflow follows a propose, confirm, verify loop: the AI proposes a patch, confirms the flaw is actually exploitable, verifies the patch closes the hole, and a human guides the process and deploys the code changes. Daybreak includes an explicit human-takeover mechanism, so an engineer can interrupt an automated workflow at any point rather than waiting for it to finish.

It also supports agent-to-agent verification, where one AI agent checks another's work before a result is treated as trustworthy. That second layer answers one of the most common criticisms of agentic security tools: that a single model can hallucinate a vulnerability that does not exist, or miss one that does, with no independent check.

James Nettesheim, Block's chief information security officer, framed the strategic shift this way: AI is compressing the time from human intent to action, and defenders can now fight fire with fire. He says the team will raise the system's risk level only as its judgment holds up in practice, which is the appropriately conservative line for a company guarding payment data at scale.

The wider bet

Block is not the only signal. In September, OpenAI committed $1 billion to Daybreak for Frontline Defenders, a program subsidizing access to its security models for water systems, electricity utilities, local governments, nonprofits, and banking institutions, with distribution running through partnerships including the MS-ISAC. Cloudflare has folded OpenAI Daybreak models into a vulnerability discovery and remediation service, pairing them with real-time traffic and security context from its global network.

The strategic argument from OpenAI's side is about what it internally calls the defender's window: frontier models give defenders capabilities that fast-moving open-weight models are also handing to attackers, and that gap may not stay wide for long. The push is to operationalize AI-driven defense now rather than treating it as a roadmap item.

Healthy skepticism still applies. Daybreak's public numbers come from the vendors and the customer telling the story, and independent verification remains thin. Whether this becomes a template for enterprise security teams will be decided by adoption, not announcements. But the direction is unmistakable: the security operations center is becoming an agent-run workflow with humans as the final authority, and Block's two-hour attack chain is the clearest public demonstration of that future so far.