OpenAI co-founder and president Greg Brockman says the company pulled a quarter of its production engineers off their roadmaps and told them their new job was defending the company: "And in the case of cybersecurity, how I think about it, we at OpenAI took our models and applied them to finding vulnerabilities." "We took 25% of our production engineers and said, sorry, all your projects are on hold. You are now defending. You are now up-leveling our security architecture. You're going to use the models to find all the holes." "And we found a number of serious issues and we fixed them." "And I've talked to a number of CISOs over the past couple of weeks and months and there are many companies who are also telling me that they've applied these models, they found some very significant issues, but that they're able to fix them." "And one positive sort of part of the story is that when we took Astra, pointed out our systems, we found some new problems, but eventually it saturated. We basically have found, to our knowledge, all of the P zeros, all of the critical problems that Astra is smart enough to find." Sit with that saturation: the scan stopped at the edge of what one model could see, not at a clean codebase, and a bug Astra can't reason about looks exactly like an empty queue. The lesson isn't the tooling, it's the staffing. Brockman's own evidence is that OpenAI put every project on hold for 25% of its production engineers and reassigned them to harden the company's systems. The model surfaced the issues, but people still had to investigate and fix them. A scanner you buy is a purchase; a quarter of your engineers is a decision someone has to make and defend. (I run TrustModel, which does independent AI evaluation.)