Not for a compliance pentest, and not on its own. Anthropic's Red Team Access tier and OpenAI's Daybreak Red tier let approved security teams use frontier models for authorized penetration testing, but they give you a model, not a test. Your team still has to scope the work, get written authorization, prove each finding against the running system and write a report someone else will accept. CodeAnt AI runs that whole test for you: AI agents attack your apps, a security researcher confirms every critical finding, and the full report arrives within 48 hours, ready for SOC 2 and ISO 27001.
CodeAnt AI has run 12,000 pentests and is trusted by more than 1,000 companies, including Fortune 500 companies like NRG, cybersecurity leaders like Commvault, and fast-growing companies like 11x and Sanas.
The question is fair. In October 2026 Anthropic opened Red Team Access to in-house red teams and penetration testing firms, and OpenAI offers a separately approved Daybreak Red model for penetration testing and red teaming. Engineering teams already give every developer an AI coding assistant. So why pay for a pentest when the same class of model can attack your app?
This guide answers it in three parts: what the labs' programs actually give you, what a penetration test has to prove that a model on its own does not, and whether your auditor will accept a test you ran yourself.
What Do Claude's Red Team Access and OpenAI's Daybreak Actually Give You?
Both labs now run verified access programs for security work. Here is what each one says it offers, read from the labs' own pages.
Anthropic: the Cyber Verification Program
On October 6, 2026 Anthropic expanded its Cyber Verification Program into three tiers:
Defense Access, for security operations, incident response, malware analysis and validating vulnerabilities in systems you own or maintain.
Red Team Access, which adds authorized penetration testing and red teaming. Anthropic says these customers "can only perform adversarial testing against systems they are authorized to test." It is open to in-house and government red teams and to security and penetration testing firms; individual researchers are not eligible. Applications take a few weeks to review.
Specialized Access, a small tier for verified organizations that test safety-critical systems such as power grids and telecom networks.
Each tier includes Anthropic's most capable models, including Claude Opus 5.5 and Claude Mythos 5.1. Enrolled organizations must retain data so Anthropic can monitor for misuse, unless they qualify for zero data retention. Without the program, Anthropic says its generally available models have conservative cyber safeguards that block most cyber work, while still allowing code review, patching known issues and finding vulnerabilities in your own source code.
OpenAI: Daybreak and Trusted Access for Cyber
OpenAI's Daybreak combines its models, Codex Security and a Trusted Access for Cyber program. Its documentation describes two tiers:
GPT-Daybreak-Blue, the default for authorized defensive work: vulnerability discovery and triage, secure code review, threat modeling, detection engineering and patch validation.
GPT-Daybreak-Red, a specialist model that needs its own approval, for proof-of-concept or exploit validation, penetration testing and red teaming.
OpenAI says to use an approved model only on systems you own or are explicitly authorized to assess, and that enterprise access covers the organization's own authorized internal work, not third-party customers or externally offered services. It also notes that legitimate security work can still trigger a safeguard that blocks or limits a request.
What neither program is
Neither program is a penetration test. Each gives a vetted team a more permissive model. The tester, the scope, the authorization, the evidence and the report are still yours. The code review tools are narrower again: Claude Code's security review and OpenAI's Codex Security read code and code changes and suggest fixes; neither is described as attacking your deployed application.
What Does a Penetration Test Prove That a Model on its Own Does Not?
A pentest buyer is paying for three jobs, and a frontier model covers part of the first one.
Find the weaknesses. Models are strong here, especially with source code. Reviewers such as Penligent point out that the public evidence for the newest models comes largely from source-visible research, which is not the same as black-box testing of a live web app from a URL and a low-privilege account.
Prove what an attacker can reach on the running system. NIST's testing guide (SP 800-115) describes penetration testing as assessors who "mimic real-world attacks to identify methods for circumventing the security features" of a system, and calls it "labor-intensive" work that should happen "only after careful consideration, notification, and planning." That means chaining issues across your real deployment, logged-in roles and tenants, and showing the request that proves the impact.
Stand behind the result. NIST says the rules of engagement provide authorization for testers to do things the organization would normally prohibit, and that testers should follow the plan unless they get permission to deviate, "normally in writing." Someone has to agree the scope, hold the authorization, decide what is a real finding and sign the report.
A model can help a skilled tester with all three. It does not take on the second and third by itself. That is also what buyers tell us on calls: teams that have run open-source agents with a lab API key describe noisy findings, agents that wander outside the scope they were given (one found the company's published SDK packages without being asked), and the worry that a lab could tighten its guardrails at any time and break their process.
Will Your Auditor Accept a Pentest You Ran Yourself With Claude or GPT?
It depends on the framework, but "we pointed a model at our app" is rarely enough.
SOC 2. The AICPA's Trust Services Criteria do not mandate a penetration test. Criterion CC4.1 asks the company to perform "ongoing and/or separate evaluations," and its points of focus name penetration testing as one type and say that "separate evaluations are performed periodically to provide objective feedback," by evaluators with "sufficient knowledge to understand what is being evaluated." Audit firm Baker Tilly calls a pentest a best practice, at least annually, and lists a missing "documented methodology aligned with industry standards such as OWASP or NIST" among the issues auditors cite. A self-run AI test can support your program; an objective, documented test is what holds up.
PCI DSS. Version 4.0.1 requirements 11.4.2 and 11.4.3 call for internal and external penetration tests at least once every 12 months by "a qualified internal resource or qualified external third party," and require that "organizational independence of the tester exists (not required to be a QSA or ASV)." Requirement 11.4.1 also asks for an industry-accepted methodology, application-layer and network-layer testing, and keeping results for 12 months. An independent in-house red team can meet that bar. The engineers who built the system cannot.
Your customers and partners. Enterprise security reviews and bank partners ask for a report with scope, method, findings and remediation status. On our calls, a fintech that already had access to both labs' cyber programs still came to us for its PCI test, for exactly the independence reason above: the team that writes the system cannot be the one that tests it.
If you have an independent internal red team, a lab's red team tier can make that team faster. If you do not, the model does not create one.
For the control-by-control detail, see our guides to SOC 2 penetration testing requirements and PCI DSS penetration testing requirements.
Which Option Fits Which Job?
Option | What it is | Who runs the test | Attacks the running system | Report and sign-off | Best for | Main tradeoff |
|---|---|---|---|---|---|---|
AI-led pentest; security researchers confirm every critical finding; black, grey and white box across web apps, APIs, cloud, Kubernetes, Active Directory and networks | CodeAnt AI | Yes | Full report within 48 hours, ready for SOC 2 and ISO 27001; the same attack rerun after every fix | Teams that owe an auditor, customer or bank partner a third-party pentest | Grey and white box tests need test accounts or code access ready before the start | |
Frontier models with fewer cyber blocks, for authorized penetration testing and red teaming | Your in-house red team or pentest firm | Only if your team builds and runs the harness | None: your team writes and signs it | Independent in-house red teams with offensive skills | Weeks-long application; individuals not eligible; data retained for misuse monitoring unless you qualify for zero retention | |
Specialist model, separately approved, for pentesting, red teaming and exploit validation | Your approved team | Only if your team builds and runs the harness | None: your team writes and signs it | Approved security teams testing their own systems | Covers your organization's own internal work, not third-party customers; safeguards can still block legitimate requests | |
Code review that finds issues in code and code changes and proposes fixes | Your developers | No; works on code | None | Catching bugs before they merge | Not described by either lab as testing your deployed app or configuration | |
Autonomous offensive security platform; findings reviewed before delivery | XBOW | Yes | Lists SOC 2, ISO 27001, ISO 42001, PCI DSS and NIS 2; free, unlimited retests | Continuous testing of web applications | No price or report deadline on its homepage | |
Autonomous testing directed and supervised by Cobalt pentesters | Cobalt | Yes | Complete pentest in 24 hours | Fast coverage between human-led tests | Cobalt says it "does not produce compliance attestation reports" |
Lab and vendor terms checked on each provider's own site on November 9, 2026. Terms change; confirm them before you decide.
Comparing AI pentest providers in more depth? See the best AI penetration testing platforms and XBOW alternatives.
When Does Running Claude or GPT Yourself Make Sense?
More often than vendors admit. A lab model is a good tool when:
You have an independent offensive team. Red Team Access or Daybreak Red can speed up recon, triage and exploit validation for people who already know what a real finding looks like.
You want coverage between tests. Run your own checks after big releases, then use an outside test for the evidence your auditor and customers need.
You are fixing code. Code review in pull requests catches many issues before they ever reach a pentest report.
You need to reproduce a reported bug. Models are useful for understanding and patching an issue someone has already found.
What it does not change: the need for written authorization for every system the agent touches, a tester who is independent of the team that built the system, and a report a third party will rely on. Engineering leaders we speak with who give every developer an AI coding assistant still keep a third-party pentest provider for that reason.
For how a pentest fits next to compliance automation tools, see compliance automation vs penetration testing for SOC 2.
Isn't an AI Pentest Vendor Just a Frontier Model With a Wrapper?
It is a fair question, and buyers ask it on calls. The model is one input. What you buy from a pentest provider is everything around it:
Scope and authorization. An agreed list of what is in and out, and written permission for every system tested.
Proof on your running system. A finding is a request your engineers can rerun, not a guess from reading code.
Human judgment on what matters. At CodeAnt AI, security researchers confirm every critical finding before it reaches you, which keeps false positives out of your report.
A report others accept. Scope, method, findings and fix status, in a form your auditor, customers and partners can read.
Retesting. The same attack rerun after every fix, so you know the fix held.
If a provider cannot show you all five, it is selling you a model.
How Does CodeAnt AI Run an AI Pentest Your Auditor Can Use?
CodeAnt AI runs AI-led penetration tests and delivers the full report within 48 hours. CodeAnt AI has run 12,000 pentests and is trusted by more than 1,000 companies, including Fortune 500 companies like NRG, cybersecurity leaders like Commvault, and fast-growing companies like 11x and Sanas.
Scope: black, grey and white box testing for web apps, APIs, cloud, Kubernetes, Active Directory, and internal and external networks. A black box test needs only your domain; grey box adds test accounts to check roles and tenant isolation; white box adds code and cloud context.
Testing: AI agents map your attack surface, chain issues into attack paths and prove what is exploitable. Security researchers confirm every critical finding before it reaches you.
Report: a SOC 2 and ISO 27001-ready report within 48 hours, with evidence and steps your engineers can rerun.
After the report: CodeAnt AI reruns the same attack after every fix, so you know the fix held.
Track record: SOC 2 Type II, named a Gartner Cool Vendor in 2026, CERT-In empanelled, and more than 100 published CVEs as a VulnCheck CNA partner, including CVE-2026-29000 in pac4j-jwt (CVSS 10.0) and CVE-2026-28292 in simple-git (CVSS 9.8).
Pricing: CodeAnt prices each pentest on the attack surface you have, and gives very generous pricing to fast-growing companies.
The tradeoff to plan for: a grey or white box test needs working test accounts or code access, and any MFA or SSO step must work for the tester before the test starts.
To book a test, go to codeant.ai/pentesting.
