- Greg Brockman of OpenAI says the best AI models can help defenders find and fix flaws now, while weaker versions spread to everyone. He says the window will not last.
- He says defenders must use frontier models on their own systems and that under-resourced critical infrastructure needs resourcing. Our reading: who gets resourced decides who benefits.
Greg Brockman, president and co-founder of OpenAI, said on the No Priors podcast that cybersecurity is in what he calls a "defenders window". The strongest AI models can help security teams find and fix flaws today, he said. Similar abilities are spreading more widely with each release, so defenders need to use the time.
What was said
Brockman said the peak frontier capabilities are not broadly diffused yet. But the cyber abilities available to everyone keep rising from one model release to the next. As an early sign, he pointed to high-profile bank hacks in South Korea that he said were driven by different models.
He described the weaknesses as old and human-made. Security was bolted onto the internet after the fact, he said, and he expects that accumulated tech debt to come to the surface.
A speaker on the show added that few companies audit their supply chain, meaning the outside code they rely on. When someone uploads a malicious package, many companies get hit at once. That speaker said fixing this was impossible with human developers alone, because so few people hold the needed expertise.
Brockman said OpenAI offers defenders access through its Daybreak program and has made a billion-dollar commitment for frontline defenders. His rule: "every time a new model drops, you need to apply it to secure yourself, find your vulnerabilities, and then saturate." He also said security now depends on the fundamentals a company has right, plus the level of cyber capability it uses. And he warned: "there is this window where that window is not going to last forever, right?"
Why it matters
Our reading: the mechanism turns defence into a repeating job. Unaudited dependencies are a stock of flaws that nobody has checked. One bad package can reach many firms at once, so a single weakness becomes a large one. By Brockman's rule, each model release changes what can be found. A scan from last quarter is then out of date.
A repeating job needs an owner and a budget. Managers can ask who re-tests after each release, and who can fix what turns up. Our reading is that the deciding factor is who gets resourced before the window narrows. Brockman pointed the same way. He said critical infrastructure that has lacked resources needs them, and he suggested security spend should vastly outstrip software spend, though he said he may not be right.
The other side
Brockman runs a company that sells these models, so his framing comes from someone with a stake. The South Korea example was his own description, and the excerpts give no detail to check it.
One host said the common industry view is a transition with more attacks before defence catches up. Brockman was optimistic that defenders can outstrip attackers. But he said it will take a lot of change in how organisations operate and how society treats critical infrastructure.
A brief note: the excerpts do not explain how a model finds flaws, or how smaller organisations outside OpenAI's programs would get access in time.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- No Priors: The Changing Physics of Cybersecurity and Drug Development with OpenAI President Greg Brockman (2026-10-15)
