Bloomberg Talks · Oct 22, 2026 · 12 min
With Greg Brockman, President of OpenAI · Matthew Prince, CEO of Cloudflare
PHP runs on roughly 70% of the world's websites, and the flaw that just forced a global patch in it was found twice this year — once by a human-guided AI model, once by one working entirely alone.
Greg Brockman, OpenAI's co-founder and president, and Matthew Prince, Cloudflare's chief executive, told Bloomberg Talks's Ed Ludlow that the fully autonomous find came a month after the guided one — the kind of speed no human security team can match.
"Hackers right now are exploiting this flaw at just incredible rates. We're seeing millions of attempted attacks using this flaw, across all of our network, every single minute of every single day." — Matthew Prince
Greg's lab built the model that found the bug with no help at all; Matthew's network is now the one absorbing the flood of attacks that followed.
The full interview is covered here so you can skip it.
Here are the 5 numbers that matter.
This Scuttlebutt Summary is available in full to premium subscribers. If you're not one already, please consider subscribing to keep reading.
Key Takeaways
PHP runs on roughly 70% of the world's websites, which is why this bug mattered
A human-guided OpenAI model found about 75–80% of the flaw; a month later OpenAI's own model found the rest, fully autonomously
Once the flaw became public, Cloudflare saw millions of attempted attacks every minute
Greg's "defender's window" is the head start frontier labs get to patch bugs before attackers catch up
Both guests expect attackers to start using AI models at scale to exploit flaws like this one
Agentic AI adoption is "hockey sticking," Greg said, citing a friend's assistant that flagged a phishing email
1. Two AI Finds, One Bug
Greg described two separate discoveries of the same PHP vulnerability, weeks apart. The first used OpenAI's public models, steered by a human expert; the second used OpenAI's own more capable internal model, with no one steering it at all.
A researcher guided OpenAI's models to about 75–80% of the flaw
"The researcher and their deep expertise, let's call it 75%, 80%." — Greg Brockman
A month later, OpenAI's own model found the complete exploit with no human guidance
"A month later, we used our latest internal model that fully autonomously found this more complete version." — Greg Brockman
The gap between the two finds was weeks; the gap between a guided tool and an unguided one, Greg's numbers suggest, is most of the work.
