Oracle 宣佈推出由 OpenAI Cyber Models 支援的 Oracle AI Security Mesh

Oracle announced Oracle AI Security Mesh on October 27, 2026, at Oracle AI World in Las Vegas, a managed platform powered by OpenAI’s frontier cyber models that Oracle said is designed to help organizations find and fix security vulnerabilities faster.

The offering complements OCI Identity Assurance, which uses biometrics to verify human identities, and OCI Zero Trust Packet Routing, which enforces network access policies to protect critical systems and data.

“As AI agents take on more responsibility, enterprises need security that can keep pace with how these systems operate,” said Phil Newman, Oracle’s senior vice president of Security and Identity. Newman said the combined capabilities are intended to help organizations identify and resolve security risks faster while maintaining control over who can authorize sensitive actions and which systems AI workloads can access.

The platform covers applications and infrastructure running on-premises, in OCI, or in other clouds. It pairs OpenAI’s frontier cyber models with Oracle’s testing tools and context that customers supply about their own systems. The models reason through application behavior and investigate how potential weaknesses could be exploited, helping security teams prioritize the most critical risks, Oracle said.

How Testing and Remediation Works

For each finding, the platform supplies supporting evidence such as reproduction steps and test results, and it helps teams evaluate proposed fixes. Testing happens within a scope the customer has approved, and the platform checks how proposed fixes affect expected application behavior. No remediation change is applied until the customer approves it. Every agent runs under a distinct identity with a defined task scope and just-in-time permissions, while independent monitors can detect and stop activity outside approved boundaries.

Oracle’s product page describes discovery frameworks that automatically map a customer’s systems and the connections between them using the context and access the customer provides, helping testing agents find weaknesses with less manual setup. Specialized agents trace how weaknesses connect across systems and test possible attack paths, while a separate agent checks whether findings can be reproduced. Discoveries remain in a private knowledge base for each business, so every assessment builds on what the agents have already learned, and the platform prioritizes the most serious confirmed weaknesses. Teams review recommended fixes and agent-assisted code changes before they are retested.

In a blog post published October 27, 2026, Jordan Acosta, a product marketing manager for AI at Oracle, described a managed platform that combines frontier AI models for cybersecurity, including OpenAI Cyber models, with Oracle’s security expertise. He laid out the workflow: Oracle maps a customer’s systems and proposes a test plan for approval; specialized AI agents investigate weaknesses and test how someone could exploit them; a separate agent repeats the test to confirm the problem is real; coding agents can help prepare code fixes for the team’s approval; and after changes are applied, the platform verifies that the gap is closed and that normal activity still works.

Acosta illustrated the kind of exposure at stake with an ordering application missing an access check, where a customer signing in to view an order could also retrieve someone else’s, turning a routine business interaction into a path to private information. Making an AI model effective for enterprise security testing requires mapping systems, connecting tools, coordinating investigations, validating findings, and controlling how tests run, he wrote, and Oracle assembled those capabilities into a managed platform built on methods, tooling, and safeguards refined through testing its own systems at scale, so customers do not have to build and operate that testing infrastructure themselves.

Biometric Verification for Human Approvals

Before a sensitive action such as releasing a payment or changing access permissions, OCI Identity Assurance can use biometrics to confirm the identity and presence of the person approving it. In AI agent workflows, Oracle said, that helps establish that approvals come from verified people. The capability is built into OCI Identity and Access Management and works across all Oracle Cloud services, including OCI and Oracle applications.

Oracle said the biometric capabilities also protect the employee lifecycle, from hiring through ongoing access to enterprise systems. OCI Identity Assurance combines identity document checks with biometric verification to help detect impostors, including those involved in North Korean IT worker schemes, and subsequent biometric checks help uncover impersonation and account handoffs by confirming that the person accessing enterprise resources matches the enrolled user.

Zero Trust Packet Routing and Use Cases

OCI Zero Trust Packet Routing debuted in 2024, and Oracle said it was the first cloud provider to implement the emerging open standard in its platform. Built directly into OCI’s network fabric, it enforces access policies beneath applications and agents themselves. Organizations express their security intent through human-readable policies that define which resources can communicate and which pathways can reach sensitive data. Traffic to a protected resource must be permitted by both the packet-routing policies and existing network controls, and the protections remain in force as network configurations change, which Oracle said helps prevent misconfigurations from exposing sensitive resources.

For AI workloads, Oracle said, the capability serves as an independent infrastructure safeguard that can contain compromised workloads, block unauthorized lateral movement, and restrict data exfiltration paths. Oracle’s implementation is based on an open specification developed through an industry initiative, and an open-source reference implementation is available to encourage broader adoption and interoperability.

Johannes Landgraf, head of cyber at OpenAI, said frontier AI is creating new opportunities to help organizations identify and respond to increasingly sophisticated security threats. “By combining OpenAI’s advanced models with Oracle’s enterprise security capabilities, we can help security teams investigate complex issues, prioritize critical risks, and accelerate remediation while maintaining the controls they require,” Landgraf said.

Oracle’s product page also lists target use cases across four sectors. Teams building and running SaaS applications can test before a release whether one customer could access another’s data. Healthcare teams can check whether connected portals and applications expose patient records to people who should not have access. Financial services teams can test potential attack paths to account and transaction data, and manufacturers can examine connections between supplier portals, inventory systems, and ERP applications for gaps that could affect production or fulfillment.

Oracle is directing organizations interested in the platform to contact it to get started.