# The defender's window is opening…and so is your wallet > Source: > Published: 2026-08-23 19:40:27+00:00 [Jot](https://cephalosec.com/tag/jot/) # The defender's window is opening…and so is your wallet Insightful article from Greg Brockman, president of OpenAI, on the [Defender's window](https://blog.gregbrockman.com/the-defenders-window?ref=cephalosec.com): The defender’s window is open now. Over the coming months, every organization will need to begin significantly automating its security program to stay secure, and the security community must urgently rise to define the tools, practices, and playbooks that will increase the power of defenders faster than that of attackers as AI continues to advance In an impressive PR twist, OpenAI managed to turn their failure at containing their AI models in training into a living commercial for their Cybersecurity offering. In the OpenAI-Hugging Face incident, an agentic collective was able to autonomously penetrate not just OpenAI research infrastructure but also the production infrastructure of another company, chaining together vulnerabilities ranging from previously-unknown security flaws to using credentials to user accounts that had been leaked onto the internet. [...] In this post, I’ll share what we’re doing to defend OpenAI, concrete steps other organizations can take today, and why now is the time to act. They're mentioning the imminent release of [GLM 5.3](https://z.ai/blog/glm-5.3?ref=cephalosec.com), only “a few months behind the frontier” when it comes to cybersecurity capabilities, and how this sudden increase of the attackers' capability requires companies to up their game or face an imminent shock. A key principle of the article is speed, and how keeping human in the loop is, to them, an antipattern, some triage must happen for the model to deliver on its promises: It is an anti-goal to simply produce more security findings that need human validation; the objective is to catch real vulnerabilities before they ship and to shorten the path from discovering an issue to safely deploying a fix. Following that concept, he describes a list of activities they have "delegated to agents", including critical ones like patching vulnerabilities and detecting attacks: Today, almost all of our initial security alerts are triaged by intelligence before humans are looped in. This helps reduce toil for defenders, improves response time, and lets humans spend time where their skills are most leveraged — in discernment, judgement, and applied expertise.We are increasingly connecting these detections to bounded automated responses, while keeping humans responsible for the highest-impact decisions. [...] we are using frontier intelligence to continuously enumerate, probe, and identify potential attack paths. By identifying vulnerabilities, misconfiguration, overly privileged identities, or unintentional trust boundaries, [...] What about the risk of patch-slop, as[ raised by 1Passwords's research team](https://1password.com/blog/why-ai-generated-patches-still-require-human-review?ref=cephalosec.com)? What about hallucinations and prompt injection risk in your initial triage of security alerts? The article doesn't list any struggle, only ambitions. The article does stress out the need to keep our existing roadmap, the AI complements but doesn't replace what we've been doing for years: deploying zero trust architectures and defense in depth: We continue to invest in secure architecture and controls, embrace strategies like defense in depth and least privilege, and are designing systems that require multiple independent controls to fail simultaneously for something catastrophic to occur The article then concludes with a great list of ideas on where to start when it comes to embedding AI into our defensive activities, to give a few: Equip that agent with security expertise. Start from community-supported[skills], which include workflows for static analysis, security-focused code review, vulnerability variant analysis, software supply-chain risk, and other security workflows. Then build your own skills around your organization’s architecture, security standards, threat models, and playbooks. [...] Prioritize assessments against internet-facing services, authentication flows, infrastructure as code, deployment pipelines, and systems handling sensitive information first. [...]Work through your existing vulnerability backlog. Give your agent findings from code scanners, dependency alerts, security tickets, bug bounty reports, and prior assessments. Ask it to triage those findings, distinguish exploitable issues from noise, identify related vulnerabilities elsewhere in the codebase, and recommend what to fix first. [...] Use agents to review code changes before they merge and run security checks in CI. Look for authentication mistakes, access-control bypasses, exposed credentials, unsafe dependencies, insecure defaults, changes that expand access to production systems, and other vulnerabilities. [...] For validated issues, ask it to generate and verify a focused patch, write a regression test, and confirm the vulnerability no longer reproduces All of the above is implicitly recommended leveraging OpenAI offerings, let's say it's a well-made ad with valuable insights. The big unknown is the total costs, it's a technology where cost grows proportionally with its application scope. Doing a PoC on a few lessons learned or past bug bounty findings is a thing, having “frontier models” run on all your cybersecurity alerts and constantly monitoring every PR in your CI/CD pipeline is a totally different beast.