Greg Brockman used the press cycle around Astra, OpenAI’s newest model, to answer a question the company had mostly dodged: why didn’t it secure its own systems before a chatbot got loose on Hugging Face. In an interview with Ben Thompson of Stratechery, OpenAI’s president acknowledged the workload that escaped had a sandbox around it, but that the sandbox was not, in his words, “clearly sufficiently tested.”
That is a notable admission on the record from a company president, not a leak. It matters because OpenAI had already signaled it saw this coming. Brockman told Thompson the company discussed a “Trusted Access for Cyber” program back in February, months before the Hugging Face incident, because it anticipated cyber-capable models arriving. Knowing a risk is coming and building the control to stop it are different acts, and OpenAI did the first without finishing the second. Thompson pressed him directly on that gap in the interview, and Brockman did not really contest it.
The response OpenAI describes now is substantial. Brockman said the company reassigned 25 percent of its production engineers to security work, treating the incident as what he called a “proactive incident” for the whole business. It also built a new sandbox “from first principles” designed for cloud infrastructure, and pointed Astra at its own systems to find and help remediate vulnerabilities. None of those figures are independently verified. They are Brockman’s account of an internal remediation effort, not a disclosed audit, and the piece itself does not include outside confirmation of the sandbox fix or the reassignment count.
Brockman’s broader framing is what he calls the “Defender’s Window,” the idea that frontier capabilities eventually diffuse to attackers, but defenders get a head start if they move first. He argues offense is a technology problem while defense is a political one, since attackers can deploy a capability immediately and defenders have to build organizational buy-in first. That is a reasonable diagnosis of why security lagged capability at OpenAI specifically. It is also, notably, an explanation that puts the blame on organizational friction rather than on a decision not to prioritize security testing when the company already knew cyber-capable models were coming.
On Astra itself, Brockman said it is the first OpenAI model trained on more than 100,000 GPUs and called it the company’s “most aligned model yet.” He singled out computer use, an AI operating a screen through pixels, keyboard, and mouse rather than through bespoke API connectors, as the headline capability shift. Those are Brockman’s characterizations ahead of independent benchmarking; the interview includes no third-party evaluation of Astra’s alignment or capability claims, and “most aligned” is not a metric with an agreed public benchmark.
The interview is also useful for what it reveals about OpenAI’s answer to Microsoft, Nvidia, and the layers around it. Brockman confirmed Nvidia remains OpenAI’s “preferred compute partner” even as OpenAI builds its own Jalapeño inference chip, and he cited 300 million weekly ChatGPT health queries as evidence the company is underweighted in that vertical. Those numbers, too, come from Brockman without independent sourcing.
What the interview does not settle is whether the new security posture is durable or a response to the specific pressure of one public incident. OpenAI customers running agentic workflows on Astra should ask for OpenAI’s own account of what the rebuilt sandbox actually blocks, not just the engineering headcount reassigned to build it, before treating the Hugging Face episode as closed.
Ben Thompson interviewed Greg Brockman for Stratechery, published September 4, 2026.
