'I no longer think we’re going to be able to patch all bugs' says AI Pandora's box opener Sam Altman: 'We're going to have to completely switch the defense model'

If you've watched as many Sam Altman interviews as I have, you'll know he's not shy when it comes to recounting a previously held opinion. Speaking at the Stanford Graduate School of Business last week, the OpenAI CEO spoke about AI safety, particularly in regards to cybersecurity.

"The cybersecurity..." Altman begins, before pausing. "I don't even know a dramatic enough word to use... but the problem coming towards us is still something that we have not, as organizational leaders, or countries, or individuals taken seriously."

"There was a moment earlier this year where... it was like the Mythos freak out, or whatever people called it, and I think things did get somewhat better. Like, people definitely patched some bugs," the OpenAI CEO continues. "But it was another one of these cases where people didn't really intuit the exponential."

"I don't think most people said, okay, the models are going to get much smarter," says Altman. "They can probably find bugs, like crazy bugs, you know, bugs that are outside of the normal threat model of what we think a hacker can do. Largely speaking, I think most organizational leaders have somewhat moved on, and the models have kept going."

"And I I no longer think we're going to be able to just patch all the bugs. I think we're going to have to completely switch the defense model to using the same technology for a new kind of defense shield."

"I think it's a huge safety and security issue, and I am somewhat astonished at how relatively little attention it's getting," he concludes.

Certainly, Anthropic's Claude Mythos model created an eye-opening moment upon its release earlier this year, with the model supposedly finding thousands of vulnerabilities in "every major operating system and every major web browser," among others.

And after the PHP vulnerability reveal last week, in which web admins scrambled to update website code to fix two critical security vulnerabilities discovered by AI, the suggestion that some sort of AI-based defense system might be of more use than a standard patching procedure certainly seems timely.

But the idea that AI itself could solve the cybersecurity problem really does feel like a snake eating its own tail. Especially coming from the CEO of a company that hit the headlines earlier this year after its own AI agents hacked their way into an outside organisation.

It's also entirely unsurprising to see one of the chief architects of the AI revolution suggest that the technology is advancing at such a rapid rate that the only thing powerful enough to keep up with it might be AI itself.

2026 has been a scary year for those of us concerned with the state of cybersecurity. Bad actors seem to be continually leveraging AI tech to further their nefarious goals, and while AI models exposing vulnerabilities to be fixed might seem like a net gain, we seem to increasingly find ourselves caught in a battle between the forces of AI good, and the forces of AI evil.

All of which is to say, here's hoping the "good guys" win. Whoever they are at this point. It's becoming increasingly harder to tell, don't you think?