The two prompts OpenAI's president ran on his own website, the 5-step defense loop OpenAI runs on itself, the safe operating rules for letting an agent click through your dashboards, and every quote timestamped
The companion to the video. Greg Brockman told a16z (Sep 14, 2026) that his coding agent found 13 vulnerabilities on his own static website in 15 minutes and, using computer use, fixed them in 45 by clicking through his Cloudflare dashboard. PAGE 1 — why this exists. PAGE 2 — the four moments, timestamped to the official upload: the 45-minute fix, the defender's window (the Hugging Face incident, verified Jul 9–13, 2026), the defense factory (find → triage → remediate → deploy → validate), and the AGI call with his claims labeled. PAGE 3 — both prompts as written, plus what his findings mean in plain English (SPF, DMARC, HTTPS redirect, security headers) and the fix for each. PAGE 4 — the five safe operating rules before you let an agent click (stay in the chair, never a dashboard that moves money, least privilege, snapshot first, verify from outside) and his loop sized for one site. PAGE 5 — the fact table: what we verified against Hugging Face and OpenAI's own posts, what is his claim, with primary sources. PAGE 6 — the beginner guides and the full interview. Independent companion from Hyperautomation Labs — not affiliated with a16z or OpenAI.
Free. No spam. Unsubscribe anytime.