unusual_whales (@unusual_whales) on X

Sam Altman, OpenAI's CEO, is saying that AI models have gotten good enough at finding security vulnerabilities that the old playbook of patching bugs one at a time no longer keeps up. The quote in the post is short, but the claim behind it is significant: models can surface bugs outside the threat models security teams usually design around, and he specifically mentions hardware-level flaws. He says he no longer thinks the industry will be able to patch all the bugs. That is a strong admission from the head of one of the companies building these systems, and it reads less like marketing and more like a warning. The reason it matters is the asymmetry it implies. Defenders have to find and fix every weakness, while an attacker only needs one that works. If models can rapidly search codebases and hardware designs for flaws that human reviewers and conventional scanners miss, the number of known vulnerabilities could rise faster than vendors can ship fixes. Hardware is the sharpest part of the claim, because firmware and chip-level bugs are expensive or impossible to patch after deployment. A flaw in silicon or in a device's boot code can sit in the field for years. The post itself is a single quote and carries no data, benchmarks, or named incidents, so treat the claim as Altman's assessment rather than a demonstrated result. What it signals is a shift in how the company expects security to work: less reliance on patch cycles, more emphasis on designing systems that assume some bugs will remain. Whether that prediction holds depends on evidence not included in this post, so it is worth reading the fuller source before drawing firm conclusions.