Block cuts time to an AI-assisted proposed security patch to 18 minutes

What is changing?

According to an OpenAI case study published on October 14, Block uses a Daybreak-based system in its security operations. The system supports vulnerability discovery, detection tuning, incident investigation, and remediation proposals in one workflow. A proposed detection change can be replayed against seven months of production telemetry in under an hour.

In measurements reported by Block, recent red-team exercises moved from a high-level vulnerability description to an automated proposed patch in 18 minutes. The system performs about 1,100 analyst-hours of investigation per quarter and gives back roughly 600 analyst-hours previously spent triaging false positives. These are company-reported results, not an independent benchmark.

The workflow is not fully autonomous: people validate every result, agents can verify one another’s work, and sensitive tasks can be routed to human review. In production, evidence trails, rollback, access boundaries, and keeping patch-deployment authority with people matter as much as speed.