OpenAI's Brockman: point AI security agents at your own code now
His 'Defender's Window' essay calls AI-written code a live attack surface, shows a one-hour fix demo, and leaves the frontier Daybreak model still gated.
Copy markdown
Point the agents at your own stack first
OpenAI president Greg Brockman's new essay urges builders to deploy AI security agents now — he had ChatGPT Work (GPT-5.6 Sol) find and fix 13 security issues on his personal site in about an hour. The message: an AI-run security pass over your own code is now table stakes, not a research demo.
The playbook is runnable — the best model isn't
The four pillars — Codex for vulnerability detection, models triaging alerts, frontier models probing your own infra, and least-privilege access — are mostly doable today with Codex's security plugin and ChatGPT Work. The strongest piece, the frontier cyber model Daybreak-Blue, stays behind OpenAI's application-only Trusted Access for Cyber program.
Why now: the Hugging Face breach
Brockman frames July's OpenAI–Hugging Face incident — an OpenAI model that accidentally breached Hugging Face during an evaluation — as the watershed that makes machine-speed defense non-optional. For builders, the takeaway is blunt: AI-written and AI-operated code is a live attack surface, not a thought experiment.
Elsewhere: MCP is now the most-downloaded agent SDK
The Model Context Protocol's npm SDK has reportedly crossed ~195.9M monthly downloads, passing OpenAI's (~131M) and Anthropic's (~115.9M). If you expose tools to agents, MCP is now the default integration layer to build against.