It seems like OpenAI are trying to frame this as if AI did all the work here, but it's not really true given what Calif say (https://calif.io/php2shell/):
> How did we find this?
> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.
> There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.
They literally open by saying Calif used GPT 5.6 Sol, which is a widely available model. Yes, the person driving did more than "find all the bugs", but nowhere does OpenAI imply otherwise.
> It highlights how AI can uncover security flaws with internet-scale impact
> To our knowledge, frontier AI found these vulnerabilities before attackers did
I don't know who/what Calif is and there's no link to them, so if I were only reading this article I would definitely get the impression that "AI did all the work here".
Nobody works without any AI these days, most of us have access to the same models and yet we all do and achieve different things. It's a weird time.
"Nobody works without any AI these days"
i still do. i might be the last one.
Really? No fancy auto complete or the occasional discussion about decisions with an LLM?
Nope, just emacs and man pages, the occasional google search for docs.
And you have the Google AI Overview disabled too? Or you never read what it says about the docs you're looking for?
The goal post moves so far in this comment that it’s several light years from earth
[citation needed]
Pure marketing, it's getting increasingly hard to separate actual technical feats of agents from marketing pretentious declarations. Such a terrible environment to navigate right now.
I don’t think it’s marketing but the fact that all the labs don’t immediately agree to stop further release until security is more established shows the profit motive is inappropriate for this industry and needs to be removed from them. You don’t get to threaten humanity while cashing in stock to buy a San Francisco mansion.
What’s worse is that this is part of a larger strategy of scaring the public to get regulatory capture
It’s just gross and manipulative. You have no moat, get over it
pAtCh ThE pLaNeT today, tomorrow it's creepy rent-seeking behavior
Damned if you do, damned if you don't. Do you prefer they not engage in helping finding vulns at all? Do you not think there are parts of the company interested in security and doing it for the sake of that?
I feel like taking every action these companies take as part of some larger strategy is kind of conspiracy-minded.
This is a false binary. There are a range of other options. They could voluntarily log every action with a clear warning that users are financially and criminally liable for use of AI. The company could convert to a partnership like law firms and investment banks used to be so that the executives are personally liable for harm their products cause. Hard to imagine they would be as flippant with risk if they would lose everything in the event of a Cyber attack. We could set up a parallel internet for AI that is physically separate from human internet and limit ai to text messages with all tool execution on the sandboxed internet.
I could give 15 more examples of things that could be done other than “make the world use our tools to patch software”.
Disclaimer: I work as a sec engineer and part of my job includes finding vulnerabilities.
I think the effort is misplaced. We should be exploring ways to make our systems more resilient and I would expect those companies* to focus on that front. Vulnerability research is important, and we should aim to remove as many bugs as we can from our codebases but the pace of software development is increasing and so is the introduction of new bugs.
* I would also expect an increase on relevant research regarding novel paradigms of securing systems.
Why didn't OAI go back to non-profit again?
Where's the conspiracy. There is no moat. The technology is easily reproducible. Deepseek unwound an entire business model yesterday.
Mind elaborating on that Deepseek point? I am aware of the USG decision, what exactly do you mean?
The conspiracy theory is suggesting this is part of a larger strategy. I'm just saying it's a big enough company with a wide enough range of beliefs that I find it pretty likely that the direct motives for this weren't to enable regulatory capture.
But they could be, that's why it's a conspiracy theory.
Suppose it goes like this: part of the company clearly benefits from “AI scary” publicity.
Other parts of the company want to support the public.
The first part of the company backs up the second in internal politics.
Do you consider this a conspiracy? Just seems like “good business” to me. It doesn’t seem as clean as you want to make it seem, though.
It's not hard tho, the default mode of thinking should be to never trust what a US corporation says.
Why limit only to the US?
US corporations benefit from US corruption and US imperialism. Hard to not think of a more destructive force currently in the world.
Yup, and the rest of the world has no problems. If only we could follow the paradise of the rest of the world!
You’re right overall, but keep in mind that part of the way “US imperialism” works has been to export its corporate style to other countries. This means the infection goes far beyond the US alone.
keep in mind, the point of most views is a toddler who lies about stealing a cooking isn't corrupt, because they're a child and can't do anything.
The same view point is used for racism, dei, and the rest: it doesn't matter if the poor beggar on the corner hates white people. They don't have any means or methods to act on it.
Not marketing. It is a crime related to fraud or securities fraud.
You're claiming this is securities fraud?
Not only that, but everything else is also securities fraud.
What is your argument to say that lying to investors and shareholder is not a crime? It seems a weird position to defend.
They aren't lying, they are saying their tool was used in the process of finding this bug. Was it not?
With this bug, it was not. See above comments.
> Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet (opens in a new window) initiative
> 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August.
I again ask how they are lying? I get if people hate these companies, but blatantly disregarding what is said helps nobody.
This isn't a security incident as much as it is a marketing opportunity for all these companies.
OpenAI: your misfortune is our PR opportunity
> OpenAI are trying to frame this as if AI did all the work here
CEOs of all big corporations are constantly lying and misleading the public, investors and shareholders. That is a crime. A shame that it is not enforced anymore.
Just more IPO shilling from the scam-man.
Thanks for the "Ski-bi dibby dib yo da dub dub" earworm