> ## Content Index
> Fetch the complete content index at: https://www.metacurity.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# North Korean hackers turn familiar faces into a $400 million crypto trap
- URL: https://www.metacurity.com/north-korean-hackers-turn-familiar-faces-into-a-400-million-crypto-trap/
- Published: 2026-11-13T13:37:20.000Z
- Updated: 2026-11-13T13:37:20.000Z
- Description: The FBI says “FaceStealer” hackers use stolen webcam footage to impersonate trusted contacts on video calls, tricking victims into installing malware and drawing their contacts into the scheme.
- Author: Cynthia B Brumfield
- Tags: Cybersecurity, News, #no-feature-image

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/FaceStealer-1.png)

FBI redacted and blurred examples of the 900 victim videos secretly recorded by North Korean hackers. Source: FBI.

**Spend less time finding cybersecurity news. Get more out of it.**

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

**A paid subscription gives you:**

- **The full Metacurity archive:** Every newsletter, searchable and browsable.
- **Our weekly long-reads roundup:** The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
- **Specialized reports and analysis:** Periodic deep dives that go beyond the daily headlines.
- **A direct role in sustaining independent journalism:** Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

**Subscribe today—and thank you for reading and supporting Metacurity.**

[Upgrade my subscription](#/portal/account/plans)

### As part of a social engineering scheme, which the FBI refers ​to as “FaceStealer,” North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 ​months using surreptitiously recorded images of people, which ‌are then used to target their contacts, the Bureau said.

Targets are lured to video chats ​on imposter versions of video meeting software such as ⁠Zoom, Microsoft Teams and Google Meet.

The targets are ​issued invitations from genuine contacts they have previously interacted with, ​but whose social media and communication accounts have been compromised and whose images have been secretly recorded.

Once on the call, the targets — ​who are also being recorded — encounter a mock technical ​error that requires a fix by clicking a link, which then ‌infects the target’s computer and social media accounts. The target’s contacts are then used to target additional people.

The FBI said it had identified and seized more than 900 victim webcam videos.

The ⁠FBI attributed the activity to a cluster of North Korean hackers known as “Sapphire Sleet” or UNC1069, a separate group ⁠from ​the North Korean hackers linked by the ​FBI and private industry to the recent $6.3 billion hack of cryptocurrency exchange ​Binance. ([AJ Vicens / Reuters](https://www.reuters.com/world/asia-pacific/north-korean-hackers-steal-more-than-400-million-using-video-images-fbi-says-2026-11-12/?ref=metacurity.com))

**Related:** [*Justice Department*](https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency?ref=metacurity.com)*,* [*UPI*](https://www.upi.com/Top%5FNews/World-News/2026/11/13/North-Korea-FBI-DOJ-cyber-hackers-video-Binance/5521794552076/?ref=metacurity.com)*,* [*FBI*](https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme?ref=metacurity.com)*,* [*IC3*](https://www.ic3.gov/CSA/2026/261112.pdf?ref=metacurity.com)*,* [*The Block*](https://www.theblock.co/news/business/2026-11-12-doj-seize-1-2-billion-binance-hack-north-korea-facestealer-439065?ref=metacurity.com)*,* [*Heise Online*](https://www.heise.de/en/news/FaceStealer-North-Korea-increasingly-targets-open-source-developers-FBI-says-11523695.html?ref=metacurity.com)*,* [*The Register*](https://www.theregister.com/cyber-crime/2026/11/12/doj-takes-aim-at-12b-in-binance-loot-as-fbi-disrupts-north-korean-scam/5309523?ref=metacurity.com)*,* [*Crypto Briefing*](https://cryptobriefing.com/doj-seizes-north-korea-facestealer-infrastructure/?ref=metacurity.com)*,* [*PC Mag*](https://www.pcmag.com/news/fbi-north-koreas-facestealer-scheme-can-hijack-identities-spread-malware?ref=metacurity.com)*,* [*NBC Los Angeles*](https://www.nbclosangeles.com/news/local/fbi-warning-facestealer-cryptocurrency-theft-scheme/3969875/?ref=metacurity.com)*,* [*The Record*](https://therecord.media/stolen-binance-crypto-recovered-doj-facestealer-disrupted?ref=metacurity.com)*,* [*Help Net Security*](https://www.helpnetsecurity.com/2026/11/13/fbi-north-korean-fake-zoom-calls/?ref=metacurity.com)*,* [*DW*](https://www.dw.com/en/us-disrupts-north-koreas-400-million-crypto-scam-fbi-says/a-79935957?ref=metacurity.com)*,* [*NextGov/FCW*](https://www.nextgov.com/cybersecurity/2026/11/fbi-disrupts-intricate-north-korean-fake-call-scheme-tied-400m-crypto-theft/417200/?ref=metacurity.com)*,* [*The Hill*](https://thehill.com/policy/technology/6217605-north-korean-hackers-stole-crypto/?ref=metacurity.com)*,* [*CoinDesk*](https://www.coindesk.com/policy/2026/11/12/north-korea-s-binance-hack-faces-u-s-crackdown-as-doj-targets-usd1-2-billion-in-stolen-crypto?ref=metacurity.com)*,* [*The Defiant*](https://thedefiant.io/news/security/doj-disrupts-north-korean-fake-call-crypto-theft-scheme?ref=metacurity.com)*,* [*Crypto Briefing*](https://cryptobriefing.com/doj-seizes-north-korea-facestealer-infrastructure/?utm%5Fsource=CryptoNews&utm%5Fmedium=app)*,* [*The Cryptonomist*](https://en.cryptonomist.ch/2026/11/13/north-korea-cryptocurrency-theft/?ref=metacurity.com)*,* [*Blockonomi*](https://blockonomi.com/binance-hack-leads-us-to-target-1-2-billion-in-stolen-crypto/?ref=metacurity.com)

### Authorities arrested 354 suspects in a joint international operation targeting vendors and buyers on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom dark web marketplaces.

Codenamed 'Operation TorNado,' this law enforcement action ran from May 2025 to October 2026 and involved agencies from 14 countries.

"Additionally, law enforcement targeted vendors and buyers active on forums, single-vendor shops, and encrypted messaging services. National authorities conducted independent investigations with Europol's support, including cross-checks via SIENA and forensic analysis," Europol said.

"The operation highlighted the evolving resilience of dark web marketplaces, which continue to adapt despite takedowns."

They seized over €60 million ($66 million) in cash and cryptocurrency, 950 kilograms of illicit drugs (including amphetamines, cocaine, ketamine, psilocybin mushrooms, MDMA, and cannabis), and 57 firearms in Europe.

Law enforcement authorities also seized more than 4.8 metric tonnes of illicit drugs, 152 firearms, and over €150 million ($166 million) in the United States.

"Following the takedown of multiple darknet marketplaces and vendor targets in the previous JCODE operation, US and international law enforcement agencies obtained intelligence to identify Dark Web drug traffickers, resulting in a series of complementary, but separate, law enforcement investigations," the US Department of Justice added. ([Sergiu Gatlan / Bleeping Computer](https://www.bleepingcomputer.com/news/security/police-arrest-354-vendors-buyers-in-global-cybercrime-crackdown/?ref=metacurity.com))

***Related:*** [*Europol*](https://www.europol.europa.eu/media-press/newsroom/news/354-dark-web-vendors-and-buyers-arrested-in-europol-coordinated-global-crackdown?ref=metacurity.com)*,* [*FBI*](https://www.fbi.gov/news/stories/operation-tornado-leads-to-more-than-350-arrests-across-14-countries?ref=metacurity.com)*,* [*Justice Department*](https://www.justice.gov/opa/pr/international-law-enforcement-operation-targeting-opioid-and-fentanyl-traffickers-dark-web?ref=metacurity.com)*,* [*CryptoNews*](https://cryptonews.net/news/security/33744387/?ref=metacurity.com)*,* [*Euroasia Review*](https://www.eurasiareview.com/13112026-354-dark-web-vendors-and-buyers-arrested-in-europol-coordinated-global-crackdown/?ref=metacurity.com)*,* [*Incrypted*](https://incrypted.com/en/us-and-its-partners-carried-out-largest-international-operation-against-darknet-drug-trafficking/?ref=metacurity.com)*,* [*UPI*](https://www.upi.com/Top%5FNews/World-News/2026/11/12/dark-web-crackdown/9101794542832/?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-25.png)

### A serious hacker attack raises alarm among the Bundeswehr, German security authorities and intelligence services. 

According to SPIEGEL, unknown persons have succeeded in entering the corporate networks of the Munich-based drone manufacturer Quantum Systems and depositing a malicious program on an update server.

Quantum Systems is a contractual partner of the Bundeswehr for several drone systems and has been supplying its products to Ukraine for years. The Munich-based company also operates its own production facilities there and has also received several “joint ventures” with Ukrainian manufacturers. 

A spokesperson for the company confirmed that it had “found a cybersecurity incident at the end of October 2026.” Initial analyses had resulted in an “active cyberattack by hostile actors”, but “together with the authorities, the threat could be quickly contained.”

In addition to the Bundeswehr Military Shielding Service (MAD), the Federal Office for the Protection of the Constitution and the Federal Office for Information Security are now also involved in the incident, according to SPIEGEL information.  
The Bundeswehr took the cyberattack so seriously that it initially left the manufacturer's entire product fleet on the ground in order not to take any risks. In the meantime, the danger is contained, according to manufacturer Quantum Systems. “There is no risk for end users and operators to operate the Quantum Systems unmanned systems. Our fleet is ready for action," it says.

According to sources, the attackers succeeded in smuggling a malicious program onto internal servers, which disguised itself as a legitimate update for the mission planning program Qbase of the Munich-based company. The software is used, among other things, to plan the flights for the Quantum recovery drone Vector, which has been used by Ukraine for years and which was also procured by the Bundeswehr. 

There it bears the name "Falke".The harmful update was also played out – but not on the drones directly, but on servers of the Bundeswehr and other customers. ([Matthias Gebauer and Marcel Rosenbach / Der Spiegel](https://www.spiegel.de/politik/massiver-cyberangriff-auf-drohnenhersteller-quantum-systems-a-354b0289-2281-4af6-a532-ee03b45d8b30?ref=metacurity.com))

**Related:** [*Militarnyi*](https://militarnyi.com/en/news/cyberattack-on-quantum-systems-hackers-attempted-to-infect-updates-for-drones-used-by-ukraine-in-particular/?ref=metacurity.com)*,* [*UNN*](https://unn.ua/en/news/drone-manufacturer-quantum-systems-which-supplies-ukraine-suffered-a-cyberattack?ref=metacurity.com)*,* [*Ukrainska Pravda*](https://www.yahoo.com/news/world/articles/german-drone-manufacturer-quantum-systems-071900579.html?guccounter=1&ref=metacurity.com)*,* [*Financial Times*](https://www.ft.com/content/783504cd-aa28-453a-a223-7a34eee86ce8?syn-25a6b1a6=1&ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/business/aerospace-defense/quantum-systems-says-grounded-german-military-drones-flying-again-after-2026-11-13/?ref=metacurity.com)

### The US Justice Department says it’s joined with the two biggest stablecoin issuers in efforts to secure almost half the money stolen when hackers absconded with more than $6 billion from the Binance crypto exchange.

The department got court authorization to seize or restrain $1.2 billion of the $2.7 billion of funds frozen by Tether and Circle Internet Group Inc. in the immediate aftermath of the Oct. 29 break-in. Investigators are continuing to pursue the rest as the hackers, whom the FBI calls TraderTraitor, try to launder the cryptocurrency through bridges, mixers and exchanges.

“The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains,” M. Scott Proctor, principal deputy assistant attorney general for national security, said in a statement. He said North Korea uses cryptocurrency theft to finance its government and weapons program.

Separately, Binance said it has covered all of the $6.3 billion in cryptoassets pilfered from customers, marking a capstone to the largest cybertheft in history.

The Oct. 29 incident, which the US government and analysts have blamed on North Korea, involved not just common cryptocurrencies like Bitcoin, but more obscure tokens that took Binance more time to find and purchase. As of Thursday, the crypto exchange had restored all of them, according to a social-media post.

“To our users and community: thank you for your patience and understanding,” Binance said in its X post.

Binance spent a mixture of its profits and other emergency funds to quickly restore most of the stolen tokens in a matter of days, but said a remaining 10% would require more effort. It pledged throughout the process to completely cover lost funds.

Hackers used a maze of tools to launder the cryptocurrencies stolen from Binance, including transferring the tokens through thousands of digital wallets and across multiple blockchains in an effort to obscure their origins. The thieves used memecoins to launder a slice of the proceeds, allowing them to pass through about $430,000 of the stolen crypto. ([Myles Miller / Bloomberg](https://www.bloomberg.com/news/articles/2026-11-12/us-details-2-7-billion-freeze-after-north-korea-s-binance-hack?ref=metacurity.com) and [Teresa Xie / Bloomberg](https://www.bloomberg.com/news/articles/2026-11-12/binance-finishes-covering-6-3-billion-of-stolen-customer-tokens?ref=metacurity.com))

**Related:** [*US Department of Justice*](https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency?ref=metacurity.com)*,* [*CoinDesk*](https://www.coindesk.com/policy/2026/11/12/north-korea-s-binance-hack-faces-u-s-crackdown-as-doj-targets-usd1-2-billion-in-stolen-crypto?ref=metacurity.com)*,* [*The Record*](https://therecord.media/stolen-binance-crypto-recovered-doj-facestealer-disrupted?ref=metacurity.com)*,* [*Fox Business*](https://www.foxbusiness.com/technology/us-authorities-freeze-billions-stolen-binance-crypto-massive-north-korean-hack?ref=metacurity.com)*,* [*The Economic Times*](https://economictimes.indiatimes.com/tech/technology/fbi-says-us-has-seized-1-2-billion-worth-of-cryptocurrency-stolen-from-binance/articleshow/135786425.cms?ref=metacurity.com)*,* [*CyberScoop*](https://cyberscoop.com/us-seizes-north-korea-hacking-infrastructure-binance/?ref=metacurity.com)*,* [*New York Post*](https://nypost.com/2026/11/12/us-news/fbi-reveals-cunning-ruse-north-korean-hackers-used-in-massive-crypto-heist/?ref=metacurity.com)*,* [*Washington Examiner*](https://www.washingtonexaminer.com/news/justice/4802216/doj-north-korea-crypto-theft-binance-hack/?ref=metacurity.com)*,* [*PCMag*](https://www.pcmag.com/news/fbi-north-koreas-facestealer-scheme-can-hijack-identities-spread-malware?ref=metacurity.com)*,* [*Nextgov/FCW*](https://www.nextgov.com/cybersecurity/2026/11/fbi-disrupts-intricate-north-korean-fake-call-scheme-tied-400m-crypto-theft/417200/?ref=metacurity.com)*,* [*Decrypt*](https://decrypt.co/383208/north-korea-stole-400-million-crypto-deepfake-video-calls?ref=metacurity.com)

### Members of Donald Trump's AI task force met on Thursday ​and discussed ways to encourage critical US sectors to report AI-powered ‌cyberattacks, according to a Trump administration spokesperson.

The task force, a group of advisers, is expected to help shape the administration’s approach to AI as the technology rapidly advances.

Of particular concern are AI-powered cyberattacks on critical infrastructure, a ​term that refers to sectors vital to the US economy and security, such ​as banking, energy and emergency services. A cyberattack on those sectors could cause real-world danger ‌or disruption.

Defense Department technology lead Emil Michael, who is also vice chair of the task force, talked about progress on setting national standards for AI developers to report safety incidents and share information about cybersecurity, according to the statement.

They also ​discussed options to ​encourage critical infrastructure ⁠providers to come forward with details about cybersecurity vulnerabilities and attacks without fear of legal consequences, according to the statement. ([Courtney ​Rozen and Raphael Satter / Reuters](https://www.reuters.com/world/us/trumps-ai-task-force-met-thursday-discussed-ai-powered-cyberattacks-2026-11-13/?ref=metacurity.com))

***Related:*** [*The Next Web*](https://thenextweb.com/news/trump-ai-task-force-ai-cyberattacks-reporting?ref=metacurity.com)*,* [*Crypto Briefing*](https://cryptobriefing.com/trump-ai-task-force-ai-cyberattack-reporting/?ref=metacurity.com)

### Check Point Software released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October.

Tracked as CVE-2026-123039, this local privilege escalation vulnerability was found in the DynamicCLI IPC (Inter-Process Communication) interface used to send privileged command requests to the root-level Gaia OS DynamicCLI (dynamic\_server) daemon.

"Check Point observed an active exploit of this vulnerability against a couple of dozen customers," the company warned in a Thursday security advisory.

"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic\_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."

The list of Check Point products vulnerable to attacks exploiting the CVE-2026-123039 flaw includes the company's Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. ([Sergiu Gatlan / Bleeping Computer](https://www.bleepingcomputer.com/news/security/check-point-patches-zero-day-that-lets-hackers-get-root-access/?ref=metacurity.com))

**Related:** [*Check Point*](https://support.checkpoint.com/results/sk/sk1000362?ref=metacurity.com)

### UK police forces must do more to prevent the wrongful arrests of people subjected to retrospective facial recognition (RFR) searches, according to a report from His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS).

HMICFRS said there is a large gap in understanding among police forces and the National Crime Agency about how RFR should be used in responsible policing.

The inspectorate blamed "fragmented and underdeveloped" frameworks for governance and legislation.

It pointed to a lack of bespoke legislation to provide a uniform approach to police facial recognition use – and said existing laws have not kept pace with the technology. HMICFRS also said the rules governing each force's use of RFR are mismatched, and called for a statutory code to be included in the forthcoming Police Reform Bill to set nationwide standards.

Illustrating the breadth of misunderstanding across forces, the report noted that despite the message being routinely communicated by National Police Chiefs' Council (NPCC) reps, individual investigators "often" thought RFR results constituted evidence rather than intelligence.

In many cases, they are unaware that RFR results require further inquiries before enforcement action can be taken.

"We found that some investigators didn't always carry out enough corroborative inquiries before acting on potential matches," the report stated. "In a small number of cases, officers relied too heavily on RFR results, which led to inappropriate investigative action.

"Although some forces had strengthened their processes after such incidents, practice remained inconsistent." ([Connor Jones / The Register](https://www.theregister.com/security/2026/11/13/brit-police-watchdog-says-cops-use-of-facial-recog-risks-wrongful-arrests/5309379?ref=metacurity.com))

**Related:** [*HMICFRS*](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/how-police-forces-and-national-crime-agency-use-retrospective-facial-recognition/?ref=metacurity.com)*,* [*UKAuthority*](https://www.ukauthority.com/articles/cyber-resilience-remains-a-challenge-for-police-forces?ref=metacurity.com)*,* [*Police Professional*](https://policeprofessional.com/news/oversight-of-retrospective-facial-recognition-must-be-improved-says-hmicfrs/?ref=metacurity.com)

### Indian cryptocurrency exchange Unocoin suspended its services after detecting unauthorized access to its servers, with the company later identifying outgoing transactions from an Ethereum (ETH) address linked to its BitGo wallet infrastructure.

Unocoin said it detected suspicious activity on November 6, 2026, followed by further unauthorized activity on November 9\. On November 12, it identified outgoing transactions from one of its Ethereum addresses used to fund ERC-20 tokens.

Unocoin said it escalated the November 12 finding to BitGo, which initiated an investigation into how the transactions could have been executed. The exchange said its BitGo enterprise accounts remain frozen and it cannot currently access them. It also said BitGo’s wallet architecture uses change addresses while processing transactions, making it difficult to establish the complete transaction activity through Blockchain records.

Unocoin has requested transaction-level details and clarification from BitGo. It said more than 90 percent of the cryptocurrency funds held on behalf of customers are maintained in cold storage. The company is working with its infrastructure and custody partners to establish the complete status of its cryptocurrency holdings and investigate any potential exposure. ([Outlook Money](https://www.outlookmoney.com/invest/unocoin-detects-unauthorised-wallet-transactions-after-security-breach-suspends-services?ref=metacurity.com))

**Related:** [*CoinTrust*](https://www.cointrust.com/market-news/unocoin-reports-server-breach-as-tracked-wallets-show-zero-holdings?ref=metacurity.com)*,* [*CNBCTV18*](https://www.cnbctv18.com/market/cryptocurrency/unocoin-suspends-all-services-after-security-breach-rebuilds-servers-from-scratch-20033292.htm?ref=metacurity.com)*,* [*NewsBytes*](https://www.newsbytesapp.com/news/science/unocoin-shuts-down-crypto-services-amid-security-breach/story?ref=metacurity.com)*,* [*Bitcoin News*](https://news.bitcoin.com/security/indias-unocoin-confirms-server-breach-arkham-shows-81k-empty-wallets/?ref=metacurity.com)*,* [*Crypto News*](https://crypto.news/unocoin-hacked-website-remains-down-as-81000-wallets-show-zero-holdings/?ref=metacurity.com)

### House Intelligence Committee ranking member Jim Himes (D-Conn.) is pushing Senate leadership to reauthorize Section 702 of the Foreign Intelligence Surveillance Act during the lame-duck session rather than waiting until Democrats gain control of both chambers in January.

Himes, who is likely to take over the House Intelligence panel next year, told POLITICO that he recently spoke with Senate Majority Leader John Thune (R-S.D.) about reauthorizing the law, which allows the intelligence community to collect data on foreign targets. 

It is due to expire in March, but intelligence officials have warned that there may be a lag in the needed judicial go-ahead if it isn’t renewed by the end of this month.

On the other hand, it would be a “betrayal of the democratic process” if Congress included a straightforward renewal of a controversial lapsed surveillance law in the annual defense policy bill, a collection of civil liberties groups called Demand Progress wrote to Hill leaders Thursday.

Lawmakers weren’t able to agree this summer to a long-term extension of Section 702 of the Foreign Intelligence Surveillance Act, under which the government can use Americans’ personal information without a warrant to search for their communications with foreign targets. A court has authorized such searches through March despite the law’s lapse. ([Maggie Miller and Gregory Svirnovskiy / Politico](https://www.politico.com/live-updates/2026/11/11/congress/himes-fisa-reauthorization-lame-duck-01161859?ref=metacurity.com) and [Tim Starks / CyberScoop](https://cyberscoop.com/section-702-reauthorization-ndaa-debate/?ref=metacurity.com))

**Related:** [*CyberScoop*](https://cyberscoop.com/section-702-reauthorization-ndaa-debate/?ref=metacurity.com)*,* [*Demand Progress*](https://www.demandprogress.org/api/media/file/NoFISANDAA.pdf?ref=metacurity.com)

### OpenAI has launched two new security products, one for penetration testing and another for defense, and warned organizations that their businesses are only safe if they use tools like these.

“We're now at a point where companies will be secure only to the extent of the frontier model that they use to defend themselves and how well they utilize that,” OpenAI President Greg Brockman said during a Thursday keynote address.

The co-founder of the company that broke security did admit that security “fundamentals are important, and not to be discounted.”

However, “you need to really reorient your security practice around what these models can do,” Brockman said, with zero irony, and presumably talking about using AI models for defense - not for hacking other organizations. “Also very important is product.”

This product, of course, should come from OpenAI, and, to that end, the company rolled out Daybreak Red Team and Daybreak Defense Factory, which are both part of OpenAI’s Daybreak security platform.

Red Team, which is available in early access, uses OpenAI models to test companies’ web applications for vulnerabilities. Nancy Wang, who leads cyber-applied AI, described it as “superhuman pen-test at the scale of automated continuous scanning,” with a fleet of agents using source code and app context to investigate and test attack paths.

It also helps security teams validate reported vulnerabilities - from code scanners, bug bounty programs, and disclosure reports - and then test the patches for these flaws.

The second product, Daybreak Defense Factory, automates the “defensive loop” by “finding, validating, and fixing vulnerabilities at scale.” This one also uses agents built on OpenAI’s latest cyber models - currently, that’s GPT-6 Cyber. The agents scan organizations’ codebases, hunting for vulnerabilities and developing patches. Engineers review and approve the proposed fixes before they go into production.

“This way engineers get a merge-ready pull request with the patch and a test that shows that it works,” Wang said. ([Jessica Lyons / The Register](https://www.theregister.com/security/2026/11/12/openai-launches-security-products-tells-orgs-theyre-doomed-if-they-dont-use-them/5309500?ref=metacurity.com))

**Related:** [*Help Net Security*](https://www.helpnetsecurity.com/2026/11/13/openai-daybreak-vulnerability-remediation-red-team-defense-factory-agents/?ref=metacurity.com)*,* [*OpenAI*](https://openai.com/daybreak/red-team/?ref=metacurity.com)*,* [*SecurityWeek*](https://www.securityweek.com/openai-unveils-daybreak-red-team-defense-factory-security-tools/?ref=metacurity.com)*,* [*Neowin*](https://www.neowin.net/news/openai-launches-daybreak-red-team-and-defense-factory-to-fix-vulnerabilities-using-ai/?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/openai-two-ai-cybersecurity-tools/?ref=metacurity.com)*,* [*The Deep View*](https://www.thedeepview.com/articles/openai-sees-a-new-enterprise-frontier-in-cyber?ref=metacurity.com)

### Best Thing of the Day: A Day Late But Still Worthy

In ‌a public forum on Monday in San Francisco, Fed Chairman Kevin Warsh [will try to understand better](https://www.reuters.com/business/finance/feds-warsh-take-stock-ai-revolution-us-public-grows-wary-2026-11-13/?ref=metacurity.com) the risks and benefits he and his colleagues may have to balance — from the possible large-scale loss of jobs to the promise of rapid economic growth and falling prices.

### Worst Thing of the Day: Cybercrims Know a Good Thing When They See It

As Microsoft continues to cope with the fallout from its unprecedented Office 365 outage, cybercriminals [are poised](https://www.infosecurity-magazine.com/news/microsoft-365-outage-security/?ref=metacurity.com) to take advantage of the chaos by launching a surge of convincing phishing campaigns and fake support scams designed to dupe individuals and employees desperate to reconnect to M365 services.

### Closing Thought

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-27.png)