Elyse Betters Picaro/ZDNET Follow ZDNET: Add us as a preferred source on Google. ZDNET's key takeaways OpenAI has launched Aardvark, a cybersecurity researcher agent. Aardvark is powered by GPT-5 and is in private beta. It can discover and help fix security vulnerabilities. In the year full of AI agents, OpenAI has launched AI assistants that can take action on your behalf to help you research, shop, and code -- and now even act as a security researcher. Also: 96% of IT pros say AI agents are a security risk, but they're deploying them anyway Aardvark, OpenAI's new agentic security researcher powered by GPT-5 and released Thursday, can assist security teams by identifying and helping patch vulnerabilities. The agent is meant to tackle existing challenges in the software security space, as tens of thousands of new vulnerabilities are discovered across enterprise and open-source codebases every year, the company said in the blog post. OpenAI noted that Aardvark began as an internal tool to help its own developers. "Our developers found real value in how clearly it explained issues and guided them to fixes. That signal told us we were on the path to something meaningful," Matt Knight, VP at OpenAI, told me. What Aardvark is (and how it works) Simply put, Aardvark is an agent that, when connected to a repository, can discover, explain, and help fix security vulnerabilities. It achieves this by leveraging LLM-powered reasoning and tool use, and taking a unique approach that can be divided into easy-to-understand stages. Also: AI is making cybercriminal workflows more efficient too, OpenAI finds As Knight explained to me, Aardvark will first examine the repository to understand what the codebase is for and its security implications, including objectives and design. Then it will look for vulnerabilities by examining past actions and new code that has been committed. As it scans, it will explain the vulnerabilities it finds by annotating the code, which humans can then review and address. Aardvark will then attempt to prove the existence of a vulnerability by placing it in a sandboxed environment, where it will attempt to trigger it. The results are then labeled with metadata that can be used to filter and dig deeper. Also: GitHub's new Agent HQ gives devs a command center for all their AI tools - why this is a huge deal Lastly, Aardvark can help the defender fix the vulnerabilities it finds by leveraging OpenAI's agentic coding assistant, Codex. Aardvark provides users with a Codex-generated and Aardvark-scanned patch for the human to review and implement. How to access Aardvark is available in private beta to select partners who are invited by OpenAI to participate. Since the tool is still in its beginning stages, OpenAI said it will use participants' feedback to refine the entire experience, working with the team to improve detection accuracy, enhance validation workflows, and provide additional benefits.