OpenAI To Release GPT-5 Powered Cybersecurity Agent

OpenAI has announced a new, AI powered threat hunting agent.

Published on Nov 3, 2025
Alex Zawalnyski Written by Alex Zawalnyski
OpenAI To Release GPT-5 Powered Cybersecurity Agent

OpenAI’s new “Aardvark” agent, currently in private beta, is designed to act like a security researcher by continuously detecting software vulnerabilities and automatically suggesting fixes. The solution is powered by GPT-5, OpenAI’s latest model, which was launched in August 2025.

Unlike some existing cybersecurity agents, Aardvark doesn’t rely on traditional program analysis techniques like fuzzing or software composition analysis, said  OpenAI  during its product announcement. 

Instead, the agent uses LLM-powered reasoning and tool-use to analyze code behavior and identify vulnerabilities. “Aardvark looks for bugs as a human security researcher might: by reading code, analyzing it, writing and running tests, using tools, and more,” OpenAI explained. 

How does it work?

Source: OpenAI
Source: OpenAI

The new tool uses a multi-stage pipeline to identify, verify, and rectify code vulnerabilities.

  1. Analysis – The tool carries out a full scan of the repository.
  2. Commit Scanning – Identify vulnerabilities by inspecting commit-level changes
  3. Validation – Potential vulnerabilities are triggered in an isolated sandbox to understand their exploitability.
  4. Patching – Integration with OpenAI Codex helps generate relevant patch. 

This process can integrate with GitHub and similar tools, ensuring that developers can maintain velocity while innovating.

According to OpenAI, the tool has already identified 10 CVEs within open-source projects.

The response

There has been some pushback within cybersecurity communities online. While many understand the benefits of incorporating LLMs and AI analysis into workflows, there is skepticism about how effective Aardvark will be.

However, some users are recognizing that the new tool won’t necessarily replace human code analysis completely, but may enable developers to focus more of their time on innovation, rather than combing through code for vulnerabilities

X user, @Muh_Saad0, highlighted an important point: “there’s a human review step right there in the middle. and then another one. humans aren’t being removed they’re being positioned as the quality gate.”

Implications

Aardvark is not the first AI-backed code analysis tool; Google launched CodeMender in October this year. During the launch, Google announced that “Over the past six months that we’ve been building CodeMender, we have already upstreamed 72 security fixes to open source projects, including some as large as 4.5 million lines of code.”

While online commentary is inevitable, there is no doubt that OpenAI’s latest tool will have a significant impact on the way that researchers identify vulnerabilities. Only time will tell, however, the extent that the Security professional’s role changes.