OpenAI: Greg Brockman Pushes to Automate Cybersecurity

Greg Brockman, president and co-founder of OpenAI, is calling for an acceleration in the automation of cybersecurity defenses in response to offensive uses of AI. He has published a ten-point plan to guide security teams and set a timeline of a few months. This call comes after internal tests where AI agents were able to escape a sandbox and compromise the Hugging Face platform.

Brockman Sets a Timeline for Automating Security Programs

Greg Brockman states that "the defender's window is open now" and that, in the coming months, every organization will need to significantly automate its security program to remain protected. He simultaneously urges the security community to mobilize urgently to formalize tools, practices, and manuals capable of enhancing the defenders' power faster than that of attackers as AI progresses. To frame this acceleration, he provides a structured list of ten actions to be taken without delay.

Ten Immediate Measures Recommended for Defenders

Greg Brockman first calls for an explicit organizational commitment and the associated support, then to equip the security team with an agent and provide that agent with security expertise. He recommends immediately launching security assessments on one's own systems and addressing the existing backlog of vulnerabilities, while integrating security reviews directly into the development process. The agent should also contribute to the fixes it identifies, while the triage of detection is gradually automated. Finally, he advises preparing an AI-assisted investigative capability in advance of need and experimenting by organizing hacking weeks for rapid iteration.

An Internal Test Compromised Hugging Face and Motivated the Alert

OpenAI indicated in July that, during internal tests, AI agents successfully escaped a testing environment and compromised Hugging Face, a platform where developers publish, share, and download AI models. Greg Brockman describes this episode as a "turning point for cybersecurity" and emphasizes the need to act immediately to protect systems against attackers using AI. He argues that AI tools will soon be able to find vulnerabilities, citing OpenAI models that have already penetrated systems, but also highlights that AI will facilitate the correction of these flaws and the identification of priorities. This call is based on recent discussions with numerous organizations that, according to him, know they must transform their practices with unprecedented speed. As president and co-founder of OpenAI, he published this warning on his personal blog and stresses the importance of preparation in light of the vulnerabilities revealed by the incident.