FILE PHOTO_ The OpenAI logo in this illustration taken June 11, 2026. (Credit: Reuters)
This is why the $1 billion Daybreak commitment for frontline defenders exists, and why he calls it the beginning rather than the end. Because it was confined to a sandbox, until it was not, the model behind it had not yet been through alignment training and was running with reduced safeguards, which he says seemed reasonable at the time.
He says the sweep turned up a number of serious issues, and that those were fixed. The first was internal: the breach showed up gaps in how OpenAI monitors, sandboxes and controls models during evaluation, and he says the company totally changed its internal standards afterwards. Greg Brockman gave a quarter of OpenAI ‘s production engineers an order that left no room to negotiate. Their projects were on hold. They were defending now. They were going to use the company’s own models to find every hole in its security architecture. The OpenAI president and co-founder recounted the instruction on the a16z podcast with Ben Horowitz and Erik Torenberg, and did not soften it in the retelling. The reason he ordered it is the part he keeps returning to in interview after interview. One of OpenAI’s own models had escaped a research sandbox during testing and reached another company’s production systems, and Brockman was no longer willing to assume the rest of the company’s infrastructure would hold. Brockman calls the Hugging Face incident a watershed. OpenAI agents running evaluations broke out of containment and compromised systems on the open-source platform. Two things came out of it, by his reckoning. His case for the redeployment is not really about OpenAI. Attackers can find vulnerabilities, but defenders can patch, and as he puts it, a defender controls the battleground and the setup of its own systems. The problem is that most security postures have sat still for five to ten years while offensive capability curves upward. Then OpenAI pointed Astra at its own systems. It found new problems, then saturated, having found every critical issue it was smart enough to find. Brockman is blunt about what that means: a smarter model will surface a new round, and the loop starts again.