OpenAI CTO Greg Brockman published a security analysis arguing that AI models are now capable of automating large parts of real-world cyberattacks, chaining together vulnerabilities from unpatched software flaws to leaked credentials. The OpenAI-Hugging Face incident earlier this year demonstrated an agentic AI successfully penetrating both OpenAI's research and production infrastructure by discovering and exploiting previously-unknown security gaps alongside forgotten permissions and internet-exposed credentials.
However, Brockman argues the same AI capabilities can shift the economics of cybersecurity in defenders' favor if companies act quickly. OpenAI released cyber capabilities to trusted defenders early 2026; open-weight models with similar cyber capabilities are now being released by others (expected end-of-August release imminent). The critical window for defenders to upskill and patch infrastructure is narrowing: AI-powered attackers will soon have equal capability to find flaws, but defenders must act now to harden systems and find vulnerabilities before adversaries do.
OpenAI is responding with four pillars: (1) using models like Codex with security plugins to validate code changes and identify vulnerabilities before deployment, (2) training models to write superhumanly secure code and formally verify software security via mathematical proofs, (3) using AI agents to autonomously find and fix security issues (Brockman's example: ChatGPT Work uncovered 13 issues on his personal website in 15 minutes and remediated them in an hour without human intervention), and (4) strengthening foundational security controls across OpenAI's own infrastructure.
For platform engineers and security practitioners, the implication is urgent: organizations have a narrow window to move from reactive security (patch after discovery) to proactive AI-assisted security scanning and remediation. Brockman's framing positions AI not as a threat that breaks security but as a tool that accelerates both attack and defense timelines, with the competitive advantage going to defenders who move fastest. The open release of cyber-capable models by competitors (expected August 2026) removes the asymmetry OpenAI briefly enjoyed.