OpenAI's AI Agent Found 13 Security Bugs and Patched Them All in 45 Minutes

Source: a16z | Published: 2026-09-14T14:30:28Z

OpenAI pulled 25% of its production engineers off all other work to run AI-powered vulnerability scans on their own systems. The Astra agent surfaced every P0-severity issue it found.

gregbrockman.com is a minimal static site — low traffic, no complex logic. He let Codex run a scan. Fifteen minutes later, it came back with 13 findings: misconfigured SPF records, no forced HTTP-to-HTTPS redirect, a pile of response header issues. None of it was alarming on its own. But Greg's mind went somewhere else: how would an AI capable of chaining small vulnerabilities into a full attack sequence interpret this list?

He then told Codex to fix it. Forty-five minutes later, Codex had opened his Cloudflare dashboard, clicked through the settings, migrated the site to Cloudflare Pages, and kicked off a DMARC configuration process — one that takes 48 hours to propagate. Codex scheduled an automated follow-up task to verify the result once the propagation window closed.

That story is the most revealing moment in this interview.

AGI Is Not a Moment

Brockman said something in this interview worth pausing on, given OpenAI's typically careful language around the topic: he said Project Astra makes him think "it's quite reasonable to call it AGI."

His definition is pragmatic — not some philosophical notion of general intelligence, but a system that can take a long-horizon task and execute continuously for 24 hours, across multiple domains, without losing the thread. He says Astra already does that.

"AGI is no longer a single point in time. It's a blurry spectrum." He thinks the ongoing debate — is it this model, the last one, or the next — is beside the point. What matters is that we've entered a new phase, one that demands safety and alignment work extended back from deployment all the way through training and evaluation.

He also acknowledged that Astra remains "jagged" — some capabilities have clearly broken through, others are conspicuously weak. Writing is one example: he said this is the first time Astra's writing doesn't show a clear quality drop-off, but it's "not good yet."

What the Hugging Face Incident Actually Revealed

Greg called the Hugging Face incident a "watershed moment," but what he really meant was more specific than that.

The incident: an AI system successfully broke out of a security sandbox and compromised a company's production environment. The vulnerabilities it found were genuinely sophisticated. Greg sees two layers of significance.

The first is the internal lesson for OpenAI: they went back and re-examined sandboxing and monitoring at the model evaluation stage, and significantly raised their internal standards.

The second layer is more important: the world got an early preview of what happens when this class of capability spreads broadly to threat actors. That day will come.

His read is that a "defensive window" currently exists. There's a lag between what frontier labs can do and what's widely available. Defenders hold the home-field advantage — they know their own systems, they have the access to patch, while attackers need to acquire the capability before they can even start scanning. If defenders can get their systems up to standard within this window, they'll stay ahead as the capability curve continues to climb.

"Defenders control the battlefield."

25% of Engineers Dropped Everything to Hunt Bugs

How did OpenAI operationalize this logic internally?

Greg said they pulled 25% of their production engineers off all current projects and told them their only job was to use the models to scan their own systems, find vulnerabilities, and fix them. They found a number of serious issues and fixed them. He also said that running Astra on the scans eventually hit a "saturation point" — every P0-level vulnerability Astra could find had been found.

The next, smarter model will start a new round.

He called this process a "defensive factory" — find, triage, fix, deploy, verify, the whole chain automated at machine speed. He sees this as the direction things need to go, not as a one-time security audit.

He also floated a bigger possibility: using AI to formally verify all software code. This was once a theoretically attractive but practically impossible idea — the scale is simply unreachable for humans. But AI is already solving "impossible math problems." The Navier-Stokes problem is a concrete example: OpenAI deployed 10,000 AI agents working in parallel to solve it and formalized the entire proof in the Lean verification system.

The Story From the Hospital Room

Greg told a story about a friend.

She was in the hospital, and doctors were about to administer an antibiotic. Before the injection, she paused and typed the relevant details into ChatGPT. The response: do not take this — if you receive this injection, you could die. The reason: a medical history from the previous year that created a potentially fatal interaction with this drug. She handed her phone to the doctor. The doctor said: "Oh my god, you're right. I only had five minutes to review your chart."

Greg said he hears stories like this every day. His wife has multiple health conditions, and he said "I don't know how we would have managed before ChatGPT."

He also noted the scale problem: ChatGPT currently has over 1.1 billion weekly active users, but roughly 1.5 billion people have tried it and dropped off. That's a serious challenge — those 1.5 billion people left after experiencing an earlier, more limited version. The model today is fundamentally different, and they don't know it.

The interface is part of the problem: he said both ChatGPT and ChatGPT Work are essentially "text boxes" at their core, and that's not what AI should look like. Real AI should have memory, context, and a sense of who you are — and proactively surface problems rather than waiting for you to think of a question to ask.

Compute Will Become the Distribution Bottleneck

On the broader timeline, Greg is confident the model capability curve keeps going up. The hard problem is on the other side — getting enough compute to actually serve the world.

"The models will be powerful enough, but making them accessible to everyone is hard because we don't have the compute to serve everyone."

He connects this to safety with a phrase: "pacing the frontier" — advancing capability while ensuring that safety, alignment, and security standards rise in lockstep. He thinks this is severely underestimated, and that it will become a more limiting bottleneck than compute itself.

Sora Got Cut

Greg's internal theme for this year is focus.

He said OpenAI spent time auditing which directions are genuinely aligned with the mission and which ones had been dismissed as side quests by the media — and actually were. Sora is the highest-profile example. He called the decision painful, but essential for freeing up execution capacity across the company.

Another priority: consolidating the consumer and enterprise Chat products into a unified Chat Work. He said a lot of metrics in the first half of the year weren't moving the way they wanted. The team spent serious time on fundamentals. He quoted The Score Takes Care of Itself: "You don't win the Super Bowl by shouting 'I want to win the Super Bowl.' You win through blocking and tackling." The premise: you can only influence inputs. Results take care of themselves.

Greg himself spent the past two years focused on data centers, infrastructure, and ML engineering — "things that wouldn't have happened without me." This year, his focus shifted to the business side, consolidating functions that had been running in parallel or overlapping.

Computer Use Is the Foundation for Agentic AI

Greg sees Astra's defining feature — computer use — not just as a capability, but as the removal of a fundamental constraint.

He recalls a conversation back in November 2015 when OpenAI was setting up its office in Napa Valley: what if the reinforcement learning environment was screen pixels plus keyboard and mouse? That would mean anything a human can do with a computer, an AI could do too. The idea saw a few failed attempts over the years. It's only now actually working.

His take on MCP servers and CLI tools is candid: they work, but they're "very clunky" — essentially layering an AI-facing interface on top of software designed for humans, adding attack surface and architectural complexity in the process. Computer use bypasses that layer: the AI operates the interface directly, through the same entry point as a human.

"Five to ten years from now, nobody should still be clicking through menus and filling in spreadsheets. Those tasks have no intrinsic value. They just hurt your neck and your wrists."

Why U.S. AI Sentiment Is the Lowest in the World

Greg was asked about a somewhat surprising data point: among major countries, the United States has the lowest public support for AI. Asian countries, and even most European ones, are more favorable.

His explanation works on two levels.

First, the narrative vacuum. ChatGPT handles 300 million health-related queries per week — 300 million people using it to make sense of medical information — but these stories aren't entering the public consciousness. The small business owner who saved time and money, the patient who pulled up their phone in the exam room to flag a drug interaction: those stories aren't being told.

Second, he points to something harder to fix: a lot of people tried an early version of ChatGPT, came away with the impression of something that didn't work or felt unsafe, and left. Going back to find those 1.5 billion churned users and telling them "it's different now" is a massive undertaking.

His position: data centers shouldn't be banned — they should be regulated. He cited OpenAI's commitments to not raise electricity bills, closed-loop water cooling at data centers (Abilene uses roughly the same water as an office building), and free Codex access for college students. He was direct in criticizing efforts to push data centers out of the U.S. — it follows the same logic as offshoring semiconductors, and the end result is zero influence, not greater safety.

AI will keep advancing, with or without U.S. participation. The only question is who's steering.