# AI scans may uncover more serious software vulnerabilities

Markdown copy of https://realalpha.app/s/ai-scans-may-uncover-more-serious-software-vulnerabilities/ on Real Alpha, the best minutes from long interviews with the people building AI. Cite and link the page, not this copy.

- Speaker: [Sam Altman](https://realalpha.app/builders/sam-altman/) · Sam Altman is CEO of OpenAI. · Co-founded OpenAI and has led it since 2019, overseeing ChatGPT's launch; formerly president of Y Combinator.
- Host: [John Collison](https://realalpha.app/people/john-collison/) · Co-founder & president, Stripe · Sold his first startup, Auctomatic, at 17, then co-founded Stripe in 2010.
- Show: Cheeky Pint
- Episode: [Why Sam Altman is against a single superintelligence](https://realalpha.app/v/iMsUcCYNKqY/), Oct 29, 2026
- Moment: 0:06 to 2:43 of the episode (3 min), playing on https://realalpha.app/s/ai-scans-may-uncover-more-serious-software-vulnerabilities/; the episode from there: https://realalpha.app/v/iMsUcCYNKqY/?t=6

## Quote

> “we are in a world of **many more serious vulnerabilities** than we expect”
> — [Sam Altman](https://realalpha.app/builders/sam-altman/) at [0:51](https://realalpha.app/v/iMsUcCYNKqY/?t=51) · Cheeky Pint

## Takeaways

1. Improving models have not yet been used across much of the internet's code.
2. Altman expects vulnerability counts to rise as scanning spreads.
3. New architectures may be more durable than patching legacy software.

## About this segment

Models are improving at vulnerability discovery, but have barely been applied across the internet's vast codebase. Sam Altman expects broader scans to expose more serious flaws and spur new software architectures.

From “Why Sam Altman is against a single superintelligence”, Oct 29, 2026. [Watch the full episode](https://realalpha.app/v/iMsUcCYNKqY/)

## Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

[0:12](https://realalpha.app/v/iMsUcCYNKqY/?t=12) I want to ask about PHP Week. Yeah. First off, how did it... Why did it take so long to find these bugs? Because it sounds like they were kind of... Why did it take, like, the 20 years, or why did it take the last few months? No, why did, like, exactly, why did it take a year? Maybe start by explaining the bug. Or the problem. So the problem is that although we have known for a while that these models are getting good at finding vulnerabilities in the wild, A, they continue to get better fairly rapidly, and B, people just hadn't really used them to go look at everything out there.

[0:48](https://realalpha.app/v/iMsUcCYNKqY/?t=48) There's like a lot of service area and a lot of code on the internet. And as people have started to do that, I think we're going to find that we are in a world of many more serious vulnerabilities than we expect, even though many people who have been following this for a while expect a lot. Yeah, I just feel like a lot of the discussion ends up being around we need to fix the software. And sure, yeah, we should fix the software, but also we maybe need to change the architectures, which is harder, but a much more durable fix.

[1:17](https://realalpha.app/v/iMsUcCYNKqY/?t=77) Like that seems to me like what needs to happen. It would seem really hard, except we have this amazing new tool to do it with. So I kind of think that's what's going to happen. And you've already seen a new generation of startups talking about building this new kind of internet or new kind of application architecture for this world where you assume that the models get smarter and smarter. What do you think the global software upgrade looks like?

[1:40](https://realalpha.app/v/iMsUcCYNKqY/?t=100) For example, is a PHP code base just a bad idea and you should rewrite a nice clean version in Rust or do we upgrade PHP? But yeah, everyone thinks that we need to upgrade all hand-spun software. Just what form will that actually take? Like, is this huge for Infosys and all those guys? Because it's going to be a lot more software consulting project. I mean, people are talking more and more about just, like, let's re-architect what it means to be a router or an operating system or an application.

[2:17](https://realalpha.app/v/iMsUcCYNKqY/?t=137) And, you know, I've seen some of these new startups saying that they're just going to, like, make a whole new stack. And that would have seemed insane two years ago. You would have been like, there's no way there's too much. you can't write all that and now maybe soon you can i would bet that we have a completely new sort of model of how we make systems and networks what else reminds you of the early internet days