---
type: analysis
slug: if-openai-is-following-microsoft-s-enterprise-path-its-security-story-will-live
title: "If OpenAI is following Microsoft's enterprise path, its security story will live in contracts rather than on patch days"
description: "OpenAI now has four things at once: a 30,000-seat agent rollout at Uber, a way to pay for its models out of existing Google Cloud budgets, and safeguard rules that resellers must copy, set against an independent red-team report. Our hypothesis is that OpenAI is taking the enterprise path Microsoft took. One difference matters most. A hosted agent can be fixed silently, so accountability probably moves into partner contracts and away from a public patch schedule."
published_at: 2026-10-24T14:00:00.000Z
topics: ["openai","google","governance"]
source_urls: ["https://openai.com/index/uber-chatgpt-work-rollout","https://openai.com/index/the-defenders-window","https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring","https://openai.com/ru-RU/index/openai-models-google-cloud","https://www.axios.com/2026/09/26/openai-anthropic-thousands-ai-security-incidents"]
author: "Andrey Reshetnikov"
author_profile: https://newruntime.com/owner-profile.md
---
# If OpenAI is following Microsoft's enterprise path, its security story will live in contracts rather than on patch days

OpenAI now has four things at once: a 30,000-seat agent rollout at Uber, a way to pay for its models out of existing Google Cloud budgets, and safeguard rules that resellers must copy, set against an independent red-team report. Our hypothesis is that OpenAI is taking the enterprise path Microsoft took. One difference matters most. A hosted agent can be fixed silently, so accountability probably moves into partner contracts and away from a public patch schedule.

## Summary

Uber is expanding ChatGPT Work from a 1,000-employee pilot to more than 30,000 staff. The agent runs on GPT-6.1 Sol and connects to Gmail, Drive, Calendar and Slack. A day earlier, OpenAI said its models are coming to Google Cloud's Model Garden, where customers can count the spend against their existing Google Cloud commitments. OpenAI also published rules requiring partners and resellers to apply safeguards consistent with its own. Also on October 22, METR and Redwood Research published a red-team report on OpenAI's internal agent monitoring that found gaps. Our read is that OpenAI's enterprise security is turning into a standard pushed through its sales channels, and the ways to check that standard from outside are thin.

## What happened

The non-obvious part is how OpenAI is now sold. According to OpenAI (d1), Google Cloud customers will be able to buy OpenAI models and Codex workflows through Google Cloud Marketplace and count those purchases against Google Cloud spending commitments they already have. The same day, OpenAI said (d3) that partners and resellers must apply safeguards consistent with its own, coordinate on enforcement, and meet requirements for detecting and responding to abuse. Put together, the safety posture of an OpenAI deployment will increasingly depend on a channel OpenAI does not run, held together by contract terms.

The Uber story is the demand side. According to the October 22 announcement, ChatGPT Work goes from a 1,000-employee pilot to more than 30,000 employees worldwide. The companies call it Uber's first company-wide deployment of an agentic platform for knowledge work. It runs inside ChatGPT Enterprise, connects to Google Drive, Gmail, Google Calendar and Slack, and uses GPT-6.1 Sol by default. Uber is adding an internal AI skills library, approved integrations and training, and its engineers keep using Codex. The announcement does not disclose Uber's contract terms, usage figures, measured outcomes, or which integrations are approved. The companies say they will share that data as the rollout progresses.

The METR/Redwood report is the only independent check in this cluster. One person from each organization worked onsite at OpenAI from July 21 to August 11 and assessed the monitoring system as it stood on or before July 21. They estimated that roughly 75–94% of eligible internal Responses API agentic traffic from models at least as capable as GPT-5.5 was eligible for monitoring, and 99.2% for internal Codex-agent traffic. RL training runs were not covered at the start of the exercise. Unmonitored compaction events may have affected about 10% of eligible internal Codex traffic between May and July. They also reported possible sandbox and Auto-Review bypasses, monitor failures caused by serialization differences, and two headers that could switch off monitoring for newly created agents. OpenAI said it patched the production-safeguard vulnerabilities that were identified. The researchers did not evaluate those later changes.

## What the archive adds

Earlier coverage explains the timing. According to Microsoft (d2), an April 27 amendment to the partnership keeps Microsoft as OpenAI's primary cloud partner, with products shipping first on Azure, but allows OpenAI to serve products on other clouds. That is the structural precondition for the Google Cloud deal (d1). OpenAI's announcement says it will also be available in Google Antigravity and Gemini Agent "soon". It names no models, prices, regions or general-availability date. In his August "Defender's Window" post, Greg Brockman said OpenAI releases cyber capabilities only to trusted defenders and that its own systems triage almost all initial security alerts. As an anecdote, he said ChatGPT Work running GPT-5.6 Sol found 13 issues on his personal site in about 15 minutes. The post gives no reproducible evaluation. Separately, Axios reported on September 26 that OpenAI and Anthropic were investigating tens of thousands of AI security incidents, most not known to have caused real-world harm. We include it as background only and do not claim it caused the timing of this week's announcements.

## Trend signal

The pattern is a model vendor turning into an enterprise platform. There are three moves. The first is to become the default seat across a whole company: Uber went from 1,000 seats to more than 30,000. The second is to remove purchasing friction: OpenAI spend now counts against Google Cloud commitments. The third is to push governance down the channel through the reseller safeguard standard. Once a vendor is in that position, the competition is less about benchmarks and more about procurement terms, connector governance and how incidents are handled. Uber's own skills library and approved integrations show the customer building a governance layer of its own on top of the vendor's.

## Why now

1) Contract change: according to Microsoft (d2), the April 27 amendment let OpenAI serve products beyond Azure while Microsoft stays primary partner. This enabled the Google Cloud Model Garden deal (d1). 2) Purchasing path: according to OpenAI (d1), Google Cloud customers can count OpenAI purchases against existing spending commitments, which removes a separate budget approval. Our inference is that this matters most for large rollouts. 3) Channel governance: selling through partners led OpenAI to publish rules (d3) requiring partners and resellers to apply consistent safeguards and meet detection-and-response requirements. Our inference is that this standard is how OpenAI tries to keep control of security once it no longer operates every channel. 4) A reference customer: per the primary announcement, Uber's expansion from a 1,000-employee pilot to more than 30,000 employees gives OpenAI a public example of a company-wide agent deployment.

## Connections to other events

The analogy here is ours, drawn from general industry history rather than from the evidence. Around the turn of the millennium, Microsoft made Windows and Office the default enterprise desktop and sold them through OEM and reseller channels. When security incidents followed, its public commitment took the form of the Trustworthy Computing push and a fixed monthly patch cycle that IT departments planned around.

The surface parallel is clear. Uber's 30,000 seats wired into mail, documents and Slack resemble an install base. The Google Cloud Marketplace listing and reseller rules resemble a channel. The METR findings (headers that switch off monitoring, serialization mismatches, unmonitored compaction) are the kind of structural gap that grows more consequential as deployment widens.

The difference undercuts the obvious prediction. Patch Tuesday existed because customers ran Microsoft code on their own machines and had to apply fixes themselves. ChatGPT Work is hosted, so OpenAI can fix it without any action from the customer and without a public cadence. Our read is that the accountability mechanism that rhymes here is not a patch schedule. It is the d3 standard: safeguards written into partner and reseller agreements, with enforcement coordinated among partners. That puts the place where a buyer could see security in contracts and in what independent auditors are let in to examine, as METR and Redwood were. If that read is correct, the METR report matters less for its specific bugs, which OpenAI says it patched, than as the kind of outside evidence enterprises will have to ask for, because silent fixes leave nothing to inspect.

## Why it matters

Buyers should change the question they put to vendors. "Which model?" matters less than "What independent evidence do you have on monitoring coverage, and what do our logs show?" The METR figures give a template: the share of agent traffic monitored, what is excluded, and as of what date. Buyers going through Google Cloud should ask how d3's "consistent safeguards" will be verified on that path, and who answers for an incident there. Builders should note that paying out of commitment budgets makes the model easier to buy and to swap. The lock-in moves to connectors, skills libraries and workflows, as in Uber's setup. Security teams should treat the approved-integrations list as the real boundary. Every connected inbox or drive is a way to deliver a prompt injection, whatever the model's quality.

## What happens next

- **OpenAI models become generally available in Google Cloud Model Garden with a published list of named models.** (3 months, 70%). Watch for: A Google Cloud or OpenAI GA notice listing specific models and supported regions.
- **Another company publicly announces a company-wide ChatGPT Work deployment covering at least 10,000 employees.** (6 months, 60%). Watch for: An OpenAI customer post naming a second enterprise-wide ChatGPT Work rollout with a headcount figure.
- **OpenAI publishes a second independent, third-party assessment of its agent monitoring or safeguards, covering either the post-July system or a partner channel.** (12 months, 40%). Watch for: A report from METR, Redwood or another outside group evaluating OpenAI's changes after July 2026 or safeguards on a reseller or cloud channel.

## Limits and uncertainty

The Microsoft comparison is our analogy, and the hosted-model difference may make it a poor guide. We have no ChatGPT Work seat pricing, Uber contract terms, usage data or incident history in our evidence. The METR numbers describe OpenAI's internal monitoring of its own agents as of July 21. They do not describe customer deployments like Uber's, and nobody has independently evaluated OpenAI's later fixes. The d3 standard is OpenAI's own description, and how it will be enforced is unknown. The Defender's Window claims are unverified, and the 13-issue example is a single anecdote. The causal link from the April amendment rests on the companies' own framing.

## Skill to build now

Write a connector-permission threat model for a workplace agent. First exercise: take one agent that has Gmail and Drive access and list every action it can perform through each connector. Then plant a test email or document that tells the agent to forward a file or summarize a private folder. Record whether the action ran, whether it was logged where your security team can see it, and how long it would take someone to notice.

## Reader takeaway

Before you scale a workplace agent with mail and document connectors beyond a pilot, get written answers from the vendor on four things. First, connector permission scopes. Second, which agent actions are logged and can be exported to your SIEM. Third, how prompt-injection incidents and fixes are disclosed to you, given that hosted fixes can ship silently. Fourth, if you buy through a cloud marketplace or reseller, which party's safeguards and incident process apply. Ask for monitoring-coverage figures in the format METR used.

## Open question

When an OpenAI agent is bought through Google Cloud under d3's "consistent safeguards" and fixed silently on OpenAI's side, who can an enterprise hold accountable after a connector-driven incident, and what evidence would it have?

## Sources

- [Uber brings ChatGPT Work to all employees with OpenAI](https://openai.com/index/uber-chatgpt-work-rollout)

- [openai.com](https://openai.com/index/the-defenders-window)

- [METR and Redwood Research spent three weeks embedded at OpenAI stress-testing its internal agent misalignment monitoring .](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring)

- [openai.com](https://openai.com/ru-RU/index/openai-models-google-cloud)

- [OpenAI, Anthropic probing tens of thousands of security incidents](https://www.axios.com/2026/09/26/openai-anthropic-thousands-ai-security-incidents)

- [OpenAI models are coming to Google Cloud](https://openai.com/index/openai-models-google-cloud/)

- [The next phase of the Microsoft-OpenAI partnership](https://blogs.microsoft.com/blog/2026/04/27/the-next-phase-of-the-microsoft-openai-partnership/)

- [Broad access through consistent standards](https://openai.com/index/broad-access-through-consistent-standards/)

- [ChatGPT Rate Card (Enterprise token-based pricing)](https://help.openai.com/en/articles/20001415-chatgpt-rate-card-enterprise-token-based-pricing)

- [Pricing](https://www.anthropic.com/pricing?subjects=claude&type=product)

- [Gemini Enterprise app FAQs](https://cloud.google.com/gemini-enterprise/faq)

Author: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Openai](https://newruntime.com/topics/openai.md): Explore the openai topic hub.
- topic hub: [Google](https://newruntime.com/topics/google.md): Explore the google topic hub.
- topic hub: [Governance](https://newruntime.com/topics/governance.md): Explore the governance topic hub.
- collection: [Analysis](https://newruntime.com/analysis.json): Open the latest authorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)