The company said it began releasing its cyber capabilities only to trusted defenders earlier this year. It also described internal use of Codex, including a security plugin, to validate code changes, identify vulnerabilities, and help developers fix them before deployment. OpenAI said that almost all initial security alerts are triaged by its intelligence systems before humans are involved, with bounded automated responses increasingly connected to detections.
Greg Brockman described using ChatGPT Work, running publicly available GPT-5.6 Sol, to review gregbrockman.com. He said it found 13 issues in about 15 minutes and then helped implement changes over roughly an hour, including DNS, TLS, jQuery, hosting, and DMARC-related work.
The post does not provide a vulnerability list, a reproducible evaluation, comparative measurements against attackers or human defenders, or independent confirmation that the cited flaws were found before attackers.