OpenAI CEO Sam Altman said that AI models are finding vulnerabilities that traditional security approaches never accounted for. Speaking in October 2026, Altman highlighted that AI is discovering flaws outside the normal threat model, including bugs at the hardware level. These are not the software vulnerabilities that security teams have spent decades hunting, but rather novel issues that challenge conventional wisdom.
Altman's comments come at a time when AI is increasingly being used for security research. AI models can analyze vast amounts of code and data, identifying patterns and anomalies that might escape human attention. This capability is particularly valuable for finding zero day vulnerabilities, which are unknown flaws that can be exploited by attackers.
Traditional security has focused on software vulnerabilities such as buffer overflows, SQL injection, and cross site scripting. These are well understood and have established mitigation strategies. However, AI is now finding flaws that fall outside these categories. Hardware level bugs, for example, can be much harder to detect and mitigate because they involve the physical components of a computer rather than its software.
Altman's argument is that the old patch by patch approach to security is no longer enough when AI can surface a novel flaw in hours. In the past, security teams would identify a vulnerability, develop a patch, and distribute it to users. This process can take weeks or months. But AI can find vulnerabilities at a much faster rate, potentially overwhelming the ability of defenders to respond.
This speed advantage cuts both ways. Attackers can also use AI to find vulnerabilities, and they may be able to exploit them before patches are available. The result is an arms race in which AI is used by both sides. Altman's warning is a call to rethink security strategies to keep pace with AI driven discovery.
One implication is that security needs to become more proactive and automated. Instead of waiting for vulnerabilities to be found and patched, systems could be designed to be resilient to unknown flaws. This might involve techniques such as formal verification, where the correctness of software is proven mathematically, or runtime protection that can detect and block anomalous behavior.
Another implication is that hardware security needs more attention. If AI can find hardware bugs, then hardware designers must incorporate security from the start. This could lead to new architectures that are inherently more secure, or to the use of AI to verify hardware designs.
Altman's comments also reflect OpenAI's own experiences. The company has been using AI agents for red teaming and has found that they can discover sophisticated vulnerabilities. This firsthand experience likely informs Altman's perspective on the changing threat landscape.
The broader tech industry is taking note. Companies are investing in AI powered security tools and rethinking their defense strategies. Governments are also paying attention, as the potential for AI to find and exploit vulnerabilities has national security implications.
However, there are also concerns about the use of AI for security. If AI can find vulnerabilities, it could also be used to create them. There is a risk that AI could be weaponized to develop new types of attacks. This is why Altman and others have called for responsible AI development and for safeguards to prevent misuse.
In conclusion, Altman's statement underscores a fundamental shift in cybersecurity. AI is changing the game by finding flaws that were previously invisible. To keep up, security must evolve from a reactive patch by patch model to a more proactive and resilient approach. The coming years will likely see significant innovation in this area as the industry grapples with the implications of AI driven vulnerability discovery.