SafetyPublished Top storyAll news from that day
Ongoing case: Cyber-capable AI models 28 stories
OpenAI pointed Astra at its own code and fixed important vulnerabilities, Brockman says
In OpenAI's 58-second video of 10 November, President and Co-Founder Greg Brockman says it uses itself as "customer zero" to work out which tools and ways of operating help secure it.
Check our sources · 10 facts from 2 sources
Video: OpenAI on YouTube
Key points
- Brockman says OpenAI took Astra, pointed it at its own codebase and infrastructure and let it run (0:00).
- He says OpenAI found a number of very important vulnerabilities and fixed them (0:06).
- He says OpenAI is using itself as "customer zero" to work out which tools and ways of operating help secure the company, and that they are replicable (0:43).
What happened
Greg Brockman, OpenAI's president and co-founder, says OpenAI pointed Astra at its own codebase and infrastructure, let it run, found a number of very important vulnerabilities and fixed them (0:06). He says OpenAI is using itself as "customer zero" to work out which tools and ways of operating help secure the company, and that they are replicable (0:43).
He says defenders should always put the latest frontier model into their defensive loop, before the broadly diffused set of models being created across the world can find the same thing (0:19). Brockman says OpenAI is producing playbooks and tools and working with partners to bring the models to defenders (0:24), and that CISOs it has talked to found a very business-critical bug that had been there for a year (0:33).
The 58-second video was published on OpenAI's own YouTube channel on 10 November 2026. Its description says it shows how OpenAI used a frontier model to find and resolve vulnerabilities in its own code and infrastructure. In the transcript Brockman gives no number of vulnerabilities, no severity, no date for the run and no model name other than Astra.
OpenAI's Daybreak page says it verifies applicants and reviews how they plan to use its models before approving access.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 10 of 10 · from OpenAI
OpenAI's Daybreak page says it verifies applicants and reviews how they plan to use OpenAI's models before approving access to its cybersecurity capabilities.
What it means for you
Our viewThis is Brockman's account in OpenAI's own clip. It gives no count of vulnerabilities, no severity, no date and no model beyond Astra, so it cannot be tested from the video. His advice to defenders is to put the latest frontier model into their defensive loop.
Separately, OpenAI's Daybreak page says it verifies applicants and reviews how they plan to use its models before approving access to its cybersecurity capabilities.
If you run security at your company, pick one codebase you own, run the latest model you can access against it, and record what it finds before you decide how far to rely on it.
It adds no new facts.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against these 2 sources.
1 Greg Brockman on how OpenAI uses frontier models for cyber defense
Open the source archived copy-
In OpenAI's video, Greg Brockman said: "We took Astra, pointed it at our own codebase, at our own infrastructure and let it run." (0:00, YouTube automatic captions)
cite00:00 We took Astra, pointed it at our own 00:01 codebase, at our own infrastructure and 00:03 let it run.
-
Brockman said: "We found a number of very important vulnerabilities and we fixed them." (0:06, YouTube automatic captions)
cite00:06 We found a number of very important 00:08 vulnerabilities and [music] we fixed 00:09 them.
-
Brockman said: "You should always take the latest frontier model and put it into your defensive loop." (0:09, YouTube automatic captions)
cite00:09 them. You should always take the latest 00:10 frontier model and put it into your 00:12 defensive loop.
-
Brockman said defenders should do that "before the broadly diffused set of models that are being created across the world are able to find the same thing." (0:19, YouTube automatic captions)
cite00:19 And you do that before the broadly 00:20 [music] diffused set of models that are 00:22 being created across the world are able 00:24 to find the same thing.
-
Brockman said: "we are not just producing the models, we are also producing playbooks and tools and working with partners to bring these models to defenders everywhere" (0:24, YouTube automatic captions)
cite00:24 to find the same thing. So we are not 00:26 just producing the models, we are also 00:27 producing playbooks and tools and 00:30 working with partners to bring these 00:31 models to defenders everywhere
-
Brockman said: "we talked to CISOs everywhere as they've been applying these models. They found that there's a bug that's been there for a year that's very business critical." (0:33, YouTube automatic captions)
cite00:33 the best possible results. And we talked 00:35 to CISOs everywhere as they've been 00:37 applying these models. They found that 00:38 there's a bug that's been there for a 00:40 year that's very business critical.
-
Brockman said: "We're using ourselves as customer zero to really figure out what are the tools, what are the ways of operating that help secure open AI and those are replicable." The captions render OpenAI as "open AI". (0:43, YouTube automatic captions)
cite00:43 able to fix it urgently. We're using 00:45 ourselves as customer zero to really 00:47 figure out what are the tools, what are 00:49 the ways of operating that help [music] 00:50 secure open AI and those are replicable.
-
The video was published on the OpenAI YouTube channel on 10 November 2026; its description calls Greg Brockman OpenAI President and Co-Founder and says he shares how OpenAI used a frontier model to identify and resolve important vulnerabilities in its own code and infrastructure.
citepublishDate 2026-11-10T08:02:15-08:00, channel OpenAI, description: OpenAI President and Co-Founder Greg Brockman shares how we used a frontier model to identify and resolve important vulnerabilities in our own code and infrastructure.
-
The video runs 58 seconds, and in the transcript Brockman does not give a number of vulnerabilities, a severity, a date for the run, or a model name other than Astra.
citelengthSeconds 58. The 30 caption segments, 00:00 to 00:50, carry no count of vulnerabilities, no severity, no date for the run and no model name other than Astra; the only other model reference is: take the latest frontier model.
2 Daybreak | OpenAI for cybersecurity
Open the source archived copy-
OpenAI's Daybreak page says it verifies applicants and reviews how they plan to use OpenAI's models before approving access to its cybersecurity capabilities.
cite
Every sentence above is checked against these 2 sources. Each fact has its own address you can cite.
Source 1 · OpenAI (YouTube channel) · 10 Nov 2026
Greg Brockman on how OpenAI uses frontier models for cyber defense
In OpenAI's video, Greg Brockman said: "We took Astra, pointed it at our own codebase, at our own infrastructure and let it run." (0:00, YouTube automatic captions)
00:00 We took Astra, pointed it at our own 00:01 codebase, at our own infrastructure and 00:03 let it run.
Brockman said: "We found a number of very important vulnerabilities and we fixed them." (0:06, YouTube automatic captions)
00:06 We found a number of very important 00:08 vulnerabilities and [music] we fixed 00:09 them.
Brockman said: "You should always take the latest frontier model and put it into your defensive loop." (0:09, YouTube automatic captions)
00:09 them. You should always take the latest 00:10 frontier model and put it into your 00:12 defensive loop.
Show all 9 factsShow fewer facts
Brockman said defenders should do that "before the broadly diffused set of models that are being created across the world are able to find the same thing." (0:19, YouTube automatic captions)
00:19 And you do that before the broadly 00:20 [music] diffused set of models that are 00:22 being created across the world are able 00:24 to find the same thing.
Brockman said: "we are not just producing the models, we are also producing playbooks and tools and working with partners to bring these models to defenders everywhere" (0:24, YouTube automatic captions)
00:24 to find the same thing. So we are not 00:26 just producing the models, we are also 00:27 producing playbooks and tools and 00:30 working with partners to bring these 00:31 models to defenders everywhere
Brockman said: "we talked to CISOs everywhere as they've been applying these models. They found that there's a bug that's been there for a year that's very business critical." (0:33, YouTube automatic captions)
00:33 the best possible results. And we talked 00:35 to CISOs everywhere as they've been 00:37 applying these models. They found that 00:38 there's a bug that's been there for a 00:40 year that's very business critical.
Brockman said: "We're using ourselves as customer zero to really figure out what are the tools, what are the ways of operating that help secure open AI and those are replicable." The captions render OpenAI as "open AI". (0:43, YouTube automatic captions)
00:43 able to fix it urgently. We're using 00:45 ourselves as customer zero to really 00:47 figure out what are the tools, what are 00:49 the ways of operating that help [music] 00:50 secure open AI and those are replicable.
The video was published on the OpenAI YouTube channel on 10 November 2026; its description calls Greg Brockman OpenAI President and Co-Founder and says he shares how OpenAI used a frontier model to identify and resolve important vulnerabilities in its own code and infrastructure.
publishDate 2026-11-10T08:02:15-08:00, channel OpenAI, description: OpenAI President and Co-Founder Greg Brockman shares how we used a frontier model to identify and resolve important vulnerabilities in our own code and infrastructure.
The video runs 58 seconds, and in the transcript Brockman does not give a number of vulnerabilities, a severity, a date for the run, or a model name other than Astra.
lengthSeconds 58. The 30 caption segments, 00:00 to 00:50, carry no count of vulnerabilities, no severity, no date for the run and no model name other than Astra; the only other model reference is: take the latest frontier model.
Source 2 · OpenAI
Daybreak | OpenAI for cybersecurity
OpenAI's Daybreak page says it verifies applicants and reviews how they plan to use OpenAI's models before approving access to its cybersecurity capabilities.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep