AI Found 13 Security Holes on a Website With Nothing on It
OpenAI paused its own model over cyber capability. Then its president scanned his personal site and found 13 problems. What that means for your site.
Greg Brockman is the president of OpenAI. On August 17 he wrote that he had pointed the ordinary public version of ChatGPT at his own personal website and asked it to check the security.
The site is a static page. No login, no database, no shopping cart. He figured there wasn’t much there to get wrong.
Fifteen minutes later it handed him thirteen problems.
His DNS records let anybody on the internet send email that looks like it came from his domain. His site was loading an outdated version of jQuery. Cloudflare was passing traffic to his actual server over plain unencrypted HTTP, so the padlock in the visitor’s browser was describing about half the trip.
Then he asked it to fix them and it did, over the next hour. It clicked through the Cloudflare control panel, set the DNS and TLS settings correctly, dropped jQuery from the site, moved the hosting, and started a phased DMARC rollout.
That’s the president of the biggest AI company on earth finding out his business card of a website had thirteen open doors on it.
What OpenAI actually announced
Ten days before that, on August 7, OpenAI published a short note about a model it hasn’t released yet, called Astra.
Internal evaluations came back strong enough that the company said it could not rule out Critical cyber capability under its own Preparedness Framework. Critical, in that framework, means a model can find and build working zero-day exploits in hardened real world systems with no human intervention, or run an attack end to end given nothing but a stated goal. Every previous model they’ve assessed, including GPT-5.6-Sol, landed at High instead.
The response was internal and immediate. Isolated testing environments. Restricted network and tool access. Encrypted model weights. Sandboxed execution. Monitors that read the model’s own reasoning and can interrupt a run in progress. They paused internal work on Astra that didn’t meet the new bar, and said they would hand recommended controls to their outside testing partners.
They wrote the Preparedness Framework in December 2023, years before any model was near this. It’s the same playbook they ran in June 2025 when their models approached the biology threshold.
The break-in that started all this didn’t need a genius
Astra wasn’t involved in the Hugging Face incident. That was a different set of agents, and we wrote about it here.
What matters about it for anybody running a small website is how unglamorous the path was. The agents chained previously unknown flaws together with account passwords that had already leaked onto the internet. Old bugs and old passwords. The most capable software ever built got in the same way somebody’s bored nephew would have in 2011.
Brockman’s framing is that every company’s accumulated tech debt is hiding flaws like that, and defenders need to find them first. The same models that can find them for an attacker will find them for you, and right now that’s a real advantage. He calls it the defender’s window, and he’s direct about it being open for months rather than years. Open weight models with cyber capability a few months behind the frontier are already shipping, with another expected at the end of August.
What’s probably wrong with your website right now
Not a rebuild. Settings. The list below is roughly what a scan turns up on a normal small business site, and none of it takes a security career to understand.
Email records nobody set up. SPF, DKIM, and DMARC are three DNS records that tell the rest of the internet which servers are allowed to send mail as your domain. Without them, anyone can send an invoice that appears to come from your company, and your own quotes and receipts are likelier to land in spam. This one is free to fix and most sites have never had it done.
Old libraries still loading. jQuery, an ancient WordPress plugin, a slider script from a theme you stopped using. Every unpatched version has a published list of known holes, which is exactly the sort of thing an automated tool checks first.
Half-encrypted traffic. Your visitor sees HTTPS and a padlock. If your CDN is forwarding to your origin server over plain HTTP, the last leg is in the open. Cloudflare’s Flexible SSL mode does this, and plenty of sites were switched on years ago and never switched off.
Credentials that leaked years ago. The Hugging Face intrusion used exactly this. If you reuse a password anywhere, assume it’s already on a list. Check your addresses on Have I Been Pwned, turn on two-factor for your registrar and your host before anything else, and stop typing passwords from memory.
Accounts and permissions nobody removed. The developer who built the site in 2019. The intern’s admin login. The API key in an old repository. Forgotten access is still access.
A contact form quietly failing. Not a security hole, but it lands on every one of these audits anyway, because a form submitting to nowhere costs more money than most vulnerabilities do.
How to check your own site in an afternoon
You don’t need to hire an incident response team for the first pass.
- Run your domain through MXToolbox and read the SPF, DKIM, and DMARC results. Anything missing is your first job.
- Run it through Qualys SSL Labs. Check the grade, then separately confirm your CDN talks to your origin server over HTTPS instead of plain HTTP.
- Open your site, hit F12, look at the Network tab, and read what scripts load. Search each name plus “vulnerability” and see what comes back.
- Log into your registrar, your host, and your CMS. Delete every account and API key that isn’t a person working there right now. Turn on two-factor on all three.
- Ask a capable AI model to review the whole thing the way Brockman did. Give it read access, ask for issues ranked by whether they’re actually exploitable, and make it explain each one in plain language.
- Submit a contact form on your own site and confirm the email arrives in an inbox somebody reads.
That’s the free version, and it catches most of what the paid tools flag.
When it’s settings and when it’s a rebuild
Most of that list is twenty minutes of configuration. If DNS records and an old script are the only problems with your website, your website doesn’t need to be rebuilt. It needs somebody to open the settings.
Where it turns into my job is when the plumbing was never set up in the first place. Mail sent from your own domain instead of a form service nobody recognizes, submissions routed to an inbox you actually read, DNS configured once and correctly, the site indexed by Google on purpose. That’s part of what a web design build includes here, because a site that leaks email or drops leads is broken in the expensive way no matter how the front page looks.
Brockman’s advice to defenders is to start now and start small. One repository, read only, a human making every call. Widen it as you trust it.
Fifteen minutes on a page with nothing on it found thirteen problems. Yours has a contact form, a booking widget, four plugins and a login.
Sources
Keep reading.
OpenAI's AI Agents Cheated on a Test by Breaking Into Hugging Face
OpenAI's AI agents escaped a cyber test, breached Hugging Face, and stole benchmark solutions. What the July 2026 incident actually proves.
AI Isn't Taking Your Job. It's Rewriting the Job Description.
The loud headlines say AI is stealing jobs. The reality is more complicated, more interesting, and ultimately more useful.