'AI is not creating the problem': OpenAI CEO Sam Altman

Its latest quarterly patch cycle reportedly addressed roughly 3,000 issues, and the company says AI assistance helped uncover most of them. Read that again: the tools didn’t create the holes; they brought a flashlight. Altman reportedly framed the findings as vulnerabilities that had built up over years, not problems AI had introduced.

Magouyrk reportedly took the timeline further, saying the work surfaced security issues accumulated over fifty years of software development. That’s the candid version of the story. Legacy systems carry undocumented dependencies, abandoned libraries, and patch queues that outpace the teams tasked with clearing them. But discovery cuts both ways. A flaw a model flags at 9 a.m. may be flagged by another model before lunch.

Sam Altman’s Argument, and Its Weak Point

Here’s the thing: the claim is defensible, but it doesn’t tell the whole story. AI didn’t invent SQL injection or the memory-safety bugs that have plagued C and C++ codebases for decades. Still, the sheer volume of discoveries complicates the reassurance.

When one vendor’s quarterly update includes 3,000 fixes, the disclosure pipeline becomes a risk surface: attackers gain a structured index of what just changed. Oracle and OpenAI are offering a countermeasure. Details about the partnership remain limited, beyond its stated scope. The account comes from Techradar, which covered the on-stage exchange.

Oracle’s AI Security Mesh: Fixes With Receipts

The AI Security Mesh is designed to show evidence for each finding, including reproduction steps, test results, and enough context for teams to verify a fix rather than guess. That’s a meaningful change from alert-only tools, which have often buried security teams in warnings they couldn’t verify.

What Security Teams Should Do Before the Next Patch Cycle

If your team is small and your estate is heavy on legacy systems, prioritise automated triage over raw discovery volume. A filtered list of, say, 200 verified flaws is more useful than 3,000 alerts nobody reads. If you have a mature application-security function with CI integration, send model-generated findings into the build pipeline and treat them as blocking checks.

The broader enterprise push matters, too. OpenAI’s published security guidance is a useful starting point for teams creating their first AI-assisted review policy. Either way, organisations need a clear process for deciding which findings to address and how quickly.

Sam Altman’s framing will be judged by whether the patch rate holds. Discovery is now cheap; remediation isn’t, and the gap between them is where the next serious breach may emerge. The flashlight is on. What we do with what it reveals remains our responsibility.

OpenAI CEO Sam Altman says AI isn’t creating new problems so much as uncovering vulnerabilities that have existed for years. That discovery makes it essential for organisations to address those issues responsibly.

Understanding the Implications

What we do with what the technology illuminates is still our responsibility. We need to act and improve our systems and processes.

As Altman argues, organisations must adapt their strategies to mitigate risks that AI has brought to light. That means investing in stronger security measures and fostering a culture of continuous improvement across teams.

FAQs

What does Sam Altman mean by AI uncovering vulnerabilities?

Sam Altman believes that AI is not responsible for creating new problems, but rather exposing existing vulnerabilities that have been overlooked over time.

How does Sam Altman view the impact of AI on society?

Sam Altman views the impact of AI as a reflection of societal issues, suggesting that addressing these vulnerabilities is essential for harnessing the full potential of AI technology.

Source: Techradar