Key Takeaways

  • Greg Brockman predicts security budgets will outstrip traditional software budgets as AI pushes the marginal cost of writing code toward zero.
  • Early internet architecture prioritized system resilience over security, accumulating massive structural debt that modern software teams still carry.
  • OpenAI committed $1 billion through its Daybreak program to arm frontline defenders with frontier models before offensive actors catch up.
  • Defenders currently hold a brief advantage called the defenders window, where peak frontier intelligence is available to defensive teams before offensive tools diffuse globally.
  • To secure internal systems against this shift, OpenAI created the OpenAI Model-Drop Vulnerability Saturation Method.

The OpenAI Model-Drop Vulnerability Saturation Method

Brockman argues that “the physics of cyber security are changing.” When code generation is free, producing software is easy, but verifying that software is safe becomes the real bottleneck. As Brockman noted, “You don't just want software. You want software that is reliable, that is secure, that you can believe in.” OpenAI uses the following five-step process to harden its infrastructure whenever peak intelligence advances:

Step 1: Pause Feature Work and Reallocate Core Engineering

We took about 25% of our production engineers and said all of your projects are on hold. You are just securing now.

Step 2: Deploy Peak Intelligence AI to Attack Own Infrastructure

Took our peak intelligence model at the time, had it poke at all of our infrastructure, red team a bunch of things.

Step 3: Build Automated Tooling for Continuous Red-Teaming

Built some tools so that it is easy to do it again over time.

Step 4: Remediate and Saturate the Model's Capability

We found a number of issues, we fixed it, and at some point we saturated the issues that this model was capable of finding.

Step 5: Repeat the Cycle with Each Subsequent Model Drop

We are going to have a next model, we are going to have to repeat that process, and that will continue.

When This Works (and When It Doesn't)

This method works immediately when a frontier model is released. Frontier labs release models to defenders first. Attackers face friction: they must jailbreak weights, fine-tune models, or wait for open-source distillation. That gap creates the defenders window. During that window, defenders can use peak intelligence to discover and patch structural security debt before threat actors build offensive tooling of equal intelligence.

This method breaks down if a company cannot stomach lost feature velocity. Halting a quarter of your engineering team stops your roadmap in its tracks. If your executive team panics after 48 hours and sends engineers back to building customer features, the audit fails. The process also creates a dangerous trap: capability saturation. When a model stops finding bugs, engineers assume the codebase is safe. In reality, you only saturated what that specific model can spot. The next frontier drop will expose a fresh layer of vulnerabilities your current model missed.

What to Do With This

If you run an engineering team, apply this cycle on the next major model release. Pick two of your eight engineers and freeze their sprint for three days.

First, hand those two engineers your API keys for the newest reasoning model. Point the model at your auth flows, API boundaries, and database permission models. Second, write scripts that wrap those model queries into repeatable security tests inside your deployment pipeline. Third, patch every bug the model flags until it cannot identify any new attack surfaces in your code. Finally, document the saturation point and schedule the exact same three-day freeze for the next model drop.