Altman warns: AI uncovers 50-year-old flaws and they will have to be fixed

AI as an uncomfortable auditor: many findings and few hands

Sam Altman has once again left a phrase worth reading twice. In his brief appearance during the Oracle conference, the OpenAI CEO acknowledged that he is surprised by the number of vulnerabilities AI systems are detecting and the "incredible, titanic" effort it will take to get ahead of the problems. This is not a warning about a future threat: it is the realization that the tools are already finding flaws that had been hidden for years.

The reading offered by Altman and Clay Magouryk, head of Oracle Cloud Infrastructure, flips the usual narrative. AI is not creating the security problem; it is bringing to light what had been piling up for decades. "I'm glad we can discover them today, rather than having to wait for some rookie hacker to let us know," summarized Magouryk, with Altman's explicit agreement.

The bottleneck is no longer finding, it is fixing

Here is the point that should concern an SMB's IT team the most. If AI multiplies the ability to locate flaws in proprietary code, in third-party dependencies and across the entire supply chain, the pace of discovery can far exceed human patching capacity. Altman said it bluntly: tackling this only with patches and manual interventions is too complex.

His proposal involves automating both identification and remediation and moving toward services that constantly supervise each other. It is an ambitious idea, but it sets a clear direction: software security stops being a one-off task and becomes a continuous process, with tools that monitor and react without waiting for someone to open a ticket.

For an SMB, the practical translation is simple: if your software inventory lives in a spreadsheet and patches are applied "when there is a gap," AI will not save you; it will show you the size of the hole. Topics we have already covered on the blog, such as the hidden flaws that bring down the Kubernetes control plane or the active attacks against critical PHP flaws, point in the same direction: the window between discovery and exploit is narrowing.

What we recommend at ForgeNEX

• Real inventory, not estimated. Before talking about AI, it is worth knowing which versions are running, which dependencies they carry and which services are exposed. Without that map, any analysis tool generates noise.
• Prioritize by exploitability, not by volume. AI can return hundreds of findings; the team must have a clear criterion to decide what gets fixed this week and what can wait.
• Automate the patching cycle. Pipelines that apply updates, automated testing and reversible deployments. It is the only way to keep pace without burning out the team.
• Continuous monitoring across the supply chain. Your code is not enough: libraries, containers and third-party integrations are also attack surface.
• Train judgment, not just tools. AI speeds up analysis, but someone has to interpret business risk.

Programming stops being a barrier (and that also carries risks)

Altman devoted part of his talk to another fundamental shift: more and more people without technical training are building applications to solve their own needs. "Now, when they need something, they create an application and they just do it," he commented. He described it as a factory inside their computer, capable of automating tasks they do not like and moving from one idea to another without getting stuck.

It is a huge opportunity for an SMB: rapid prototypes, internal automations, less dependence on long development cycles. But the other side should not be overlooked. If anyone can create software, anyone can create insecure software. The democratization of development must be accompanied by minimum rules: review of generated code, access control, secrets management and testing before putting anything into production. We saw it with the AI agents that escape: autonomy without limits comes at a high price.

"I want to study new types of services that constantly supervise each other and do not allow anyone to take advantage of these vulnerabilities," said Altman.

Productivity and science: the background narrative

The OpenAI CEO also spoke about productivity, with testimonials from people who feel twice as effective and enjoy their work more, and about the leap from chatbots to programming agents and systems that contribute to scientific research, with mathematics, chip design or the search for treatments as fields with the greatest potential.

It is a suggestive discourse, but for an SMB the priority remains the concrete: more secure software, more efficient services and controlled costs. The promise of better tools does not excuse anyone from doing their homework. If AI is going to uncover more flaws than we are used to seeing, the question is not whether to adopt it, but whether we have the process to manage what it finds.

Our recommendation is to start small and measurable: choose a critical system, run an AI-assisted analysis, compare the findings with what we already knew and set up a remediation flow with owners and deadlines. Repeat the cycle and expand. Security is not solved with a tool, it is solved with a habit.

Source: Computerworld. Analysis and adaptation: ForgeNEX.