OpenAI's Oct. 14 stories put Daybreak in three customer environments

OpenAI published three customer stories on October 14, 2026. Read together, they are one cluster: Third Moment Research, SentinelOne, and Block describing Daybreak already in their environments. The time and scale numbers are company claims carried on OpenAI's pages. They are not independently measured results.

Third Moment runs the long session, then checks the box

Third Moment, a North American technology startup, says it runs 10,000 agents at once on autonomous research sessions of 36 to 48 hours. The page also reports a 97 percent reduction in backtest time with Codex and 1 trillion OpenAI tokens in a single day. Codex, GPT-6 Astra, GPT-6 Sol, and GPT-6.1 Sol support that research system. Co-founder Adam Khakhar says, "In a single session, GPT-6.1 Sol is able to maintain a coherent thread of computational research across days of compute without losing the plot."

The 97 percent callout sits beside a specific Codex case. The page does not say in so many words that they are the same measurement. In that case, Codex with GPT-5.6, the latest GPT model at the time, analyzed recorded simulation trajectories, timestamps, and the codebase. A trading-strategy backtest across a year of order-level US equity data took several hours. Waiting agents polled for completion, wasting tokens and filling their context with status checks. After profiling the job, Codex identified a caching optimization and a memory-packing technique, experimented, and deployed the fix, cutting that backtest from about three hours to about three to five minutes.

Daybreak is the gate in front of that loop, not the loop itself. Before simulations launch, the team uses the platform to test whether an agent could break out of its research environment and access the wider network. Khakhar says that without Daybreak, "we would not be able to autonomously test this at scale." Third Moment's stated ambition is larger: hundreds of thousands of collaborating subagents, with people shaping how the research runs instead of doing every experiment.

SentinelOne's eight-hour reverse engineering

SentinelOne's story is one comparison. Chief AI Officer Gregor Stewart says reverse-engineering a sophisticated piece of malware can take a top security researcher four to six weeks. He says Daybreak can now produce human-level output in roughly eight hours: "Something that would've taken a top-flight researcher four or six weeks to do, AI is now doing at human-level output in something like eight hours."

The use he describes is capacity. Faster analysis gives researchers room to investigate more samples and connect findings that isolated investigations might miss. He calls that "a kind of intelligence that we were never able to afford before." Accountability stays with the team. "The only thing that can't be automated is accountability," he says. A decision to change architecture still needs human eyes. Point fixes that do not fundamentally change how the software works might be better suited to automation. Stewart also says almost everyone at SentinelOne now has access to expertise that was in very short supply until a few months ago, and he wants those capabilities in code creation so developers can address security issues as they build.

Block's shorter clocks, with a human still signing off

OpenAI's page on Block, the company behind Square, Cash App, and Afterpay, says the security team uses an OpenAI Defense Factory, with AI systems including Daybreak, to do in hours work that used to take weeks. Chief Information Security Officer James Nettesheim says, "AI is compressing the time from human intent to action," and that Daybreak and related tooling let defenders "fight fire with fire."

The page's figures are specific. A proposed detection change can be replayed against seven months of production telemetry in under an hour. That used to mean requerying hundreds of old cases by hand, and often did not happen because it was so time-consuming. In a recent red-team exercise, a model given a few hints about an internal system produced a full attack path in about two hours, work the page says would typically take a human red teamer several days. In recent red-team exercises, the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes. The fix path still has a person on it: locate the issue in the code, identify the owner, propose a patch, confirm exploitability, and verify the repair, with a human guiding deployment.

On the queue, Block reports roughly 600 analyst-hours a quarter handed back from false-positive triage, about 1,100 analyst-hours of investigation completed each quarter, a 50 percent boost to triage throughput, and a 50 percent increase in intelligence gathering and investigations. Nettesheim says every alert now gets a full investigation. Block's security harness is built on Daybreak to route tasks to different models, with hooks for a human to take over or for agents to check one another's work. The page says work is routed to human review when that is the responsible path. Nettesheim says the team will raise the risk level only as the systems' judgment holds up in practice.

What a defender can take from the cluster

Read together, the three pages are OpenAI's published accounts of Daybreak already in three different customer workflows: a research lab testing its own sandbox, a security vendor shortening malware analysis, and a payments company replaying detections and proposing patches. They are not the same workflow. None of the clocks is an outside measurement. Humans remain accountable at SentinelOne and Block. Third Moment's Daybreak use is a breakout test before simulations launch, not a claim that agents have replaced its researchers.

Read the three October 14 pages side by side before treating any figure as a benchmark. Match each clock — research session, reverse engineering, detection replay, or patch proposal — to work you already time, and keep the result labeled as a vendor-reported claim until someone outside the engagement measures it.