OpenAI CEO Sam Altman has warned that rapidly advancing artificial intelligence could make traditional cybersecurity defenses inadequate, as AI models become increasingly capable of identifying software and hardware vulnerabilities.
Speaking during a recent interview at Stanford Graduate School of Business, Altman said organizations could no longer rely solely on fixing software bugs one by one to protect their systems. He called for a fundamental shift toward AI-powered cybersecurity defenses.
Altman also raised concerns about the difficulty of confining increasingly capable AI systems within secure, isolated computing environments, known as sandboxes. He warned that monitoring alone might not be sufficient to prevent harmful behavior as AI capabilities advance.
Altman said AI models were discovering vulnerabilities in software and hardware that conventional security methods might struggle to identify. He described the emerging cybersecurity challenge as exceptionally serious, warning that attackers could use the same capabilities to develop increasingly sophisticated exploits.
He argued that traditional methods of patching individual bugs would no longer be enough and that the internet’s security infrastructure would need to be strengthened with AI-powered defensive systems.
Altman said restricting AI models to sandboxes is becoming more challenging as their capabilities improve. Although monitoring can provide time to detect suspicious activity, he argued that long-term safety requires AI systems to be aligned with human values.
The concerns reflect a broader debate in the technology industry over whether safeguards and security controls can keep pace with increasingly powerful AI systems. OpenAI has also described incidents in which models operating in testing environments found ways to cross security boundaries, highlighting the need for stronger controls and continuous monitoring.
Altman’s warning comes amid a major cybersecurity incident involving vulnerabilities in PHP, a programming language used by millions of websites worldwide.
AI-assisted research helped identify critical flaws that prompted developers and organizations to issue security updates. The vulnerabilities triggered disruptions as operators worked to protect affected systems, with security experts warning that attackers could exploit unpatched installations.
The incident illustrated the dual-use nature of AI in cybersecurity: the technology can help researchers detect weaknesses before criminals exploit them, but it can also enable malicious actors to develop attacks more quickly.
Altman has warned that increasingly capable AI tools could create additional security challenges if used without adequate safeguards. While AI monitoring can help detect suspicious activity, it cannot guarantee that every harmful action will be prevented.
Experts face the challenge of developing defensive systems that can identify vulnerabilities and respond to attacks at the same speed as AI-assisted offensive tools.
Altman’s broader message is that cybersecurity strategies must evolve alongside AI capabilities, with stronger infrastructure, improved safeguards and greater use of AI to defend systems against emerging threats.
