Oracle launches AI security mesh with OpenAI to fix flaws

Oracle has launched Oracle AI Security Mesh with OpenAI to help organisations find and fix security vulnerabilities more quickly.

The product sits alongside Oracle's existing identity and network security products in its cloud infrastructure portfolio.

The system combines OpenAI cyber models with Oracle testing tools and customer-supplied context about their own systems. It is designed to work across applications and infrastructure running on-premises, in Oracle Cloud Infrastructure, and in other clouds.

It examines application behaviour, investigates potential weaknesses and helps assess proposed fixes. It also provides evidence, including reproduction steps and test results, and can test proposed fixes within a customer-approved scope before any change is applied.

Oracle said customers must approve remediation changes before the system applies them. Each agent has a separate identity, task scope and just-in-time permissions, while independent monitors are designed to detect and stop activity outside approved boundaries.

“As AI agents take on more responsibility, enterprises need security that can keep pace with how these systems operate,” said Phil Newman, Senior Vice President, Security and Identity, Oracle.

“With Oracle AI Security Mesh and Oracle's identity and network security capabilities, we're helping organizations identify and resolve security risks faster while maintaining control over who can authorize sensitive actions and which systems AI workloads can access,” Newman said.

Identity checks

Oracle also highlighted OCI Identity Assurance, which uses biometric verification to confirm that a user approving sensitive actions is the authorised person. This can apply to actions such as releasing payments or changing access permissions in AI agent workflows.

Built into OCI Identity and Access Management, the service works across Oracle cloud services and applications. It combines identity document checks with biometric verification to detect impostors and identify impersonation or account handoffs over time.

Oracle pointed to risks linked to fraudulent hiring and access schemes, including those associated with North Korean IT worker operations. It said repeated biometric checks can help confirm that the person accessing enterprise resources matches the enrolled user.

Network controls

Oracle also linked the launch to OCI Zero Trust Packet Routing, a network security product introduced in 2024. The system is built into OCI's network fabric and is designed to enforce access policies below the application layer.

The product lets organisations set human-readable policies defining which resources can communicate and which routes can reach sensitive data. Traffic to protected resources must be allowed by both zero trust routing policies and existing network controls.

Oracle said this approach is intended to maintain protections even when network configurations change. For AI workloads, it can help contain compromised workloads, block unauthorised lateral movement and restrict paths for data exfiltration.

OpenAI said the partnership reflects growing demand for tools that can help security teams handle more complex threats. Oracle is using OpenAI's cyber models as part of the new service.

“Frontier AI is creating new opportunities to help organizations identify and respond to increasingly sophisticated security threats,” said Johannes Landgraf, Head of Cyber, OpenAI.

“By combining OpenAI's advanced models with Oracle's enterprise security capabilities, we can help security teams investigate complex issues, prioritize critical risks, and accelerate remediation while maintaining the controls they require,” Landgraf said.

Oracle said its zero trust routing work builds on an open specification developed through an industry initiative, with an open-source reference implementation intended to support wider interoperability.