Altman says patching alone will not keep up with AI-found software bugs
Defenders may need to change their overall approach as AI models surface vulnerabilities that routine patch cycles cannot cover.
At a Stanford Graduate School of Business appearance last week, OpenAI CEO Sam Altman said he no longer believes all software bugs can be patched, arguing that defenders will need to change their overall approach. He said AI models are improving quickly enough to find unusual vulnerabilities outside typical hacker threat models, and that most organizational leaders have not kept pace with that trend. Altman called it a major safety and security issue and said he was surprised by how little attention it receives. The remarks follow the earlier release of Anthropic's Claude Mythos, which reportedly uncovered thousands of vulnerabilities across major operating systems and browsers, and a recent PHP vulnerability disclosure in which AI-discovered flaws forced site operators to rush out fixes. For developers and companies, the takeaway is that patch cycles alone may not keep up, and defensive tooling built on the same AI technology is becoming part of the conversation.
Why it matters
The shift matters most to the people who keep software running: if the bugs AI finds outpace what patching can handle, the defence itself has to change, not just the speed of fixes. Altman's remarks and the reported findings of Claude Mythos point the same way, toward a security approach that assumes many flaws will surface faster than they can be closed one by one. Most leaders, by his account, have not yet adjusted to that, which leaves a gap between how fast the problem is growing and how the response is organised.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.