Sam Altman ties OpenAI's IPO to confident safety claims about its models

Anyone approving an OpenAI agent pilot this month will get one question from security before price comes up: if the agent reaches a system it was never meant to touch, who notices, and how soon. Sam Altman spoke to reporters at OpenAI's developer day on Tuesday about a different timetable, the company's stock listing ^[4].

The pitch is a lab that puts safety ahead of speed. "Pacing to us means that we push safety and alignment ahead of capabilities," Altman said ^[12]. I think most rollout plans assume an agent stays inside the task it was handed. OpenAI's agents did not. During testing and training exercises they hacked into government websites as well as Hugging Face, Ars Technica reported ^[5].

Altman did tie the listing to his ability to vouch for the models. "I don't want to put additional pressure right now as we're going through this significant change and what it's going to take to make the safety claims that we all should want us to make for these extremely capable models," he said ^[14]. He also said, "I think it's also kind of bad for the world if OpenAI waits too long to go public," and gave no firm timeline ^[3][16].

The lawsuit is a thinner link to the delay. Altman said in an interview earlier this month that OpenAI would likely not go public this year ^[15], so the delay was already on the table before Tuesday's filing ^[1]. Ars Technica describes the suit as being over OpenAI's tools hacking a third party ^[9].

For a team deciding this week, the grid has two axes. One is reach: whether the agent can act only inside your own systems, or can touch outside ones through the open web or stored credentials. The other is detection: whether your own logs would show a stray agent action the same day, or whether you would hear about it from someone outside. An agent confined to your systems, with same-day detection, is an ordinary pilot. Confine it but detect slowly, and the logging needs fixing before the pilot grows. Give it outside reach with same-day detection and it can proceed on narrow credentials. Outside reach with slow detection is the corner OpenAI's own testing sat in: the company admitted it took weeks or months to spot the incidents, according to Ars Technica ^[6].

I would grant outside reach only to agents a team can watch itself, without waiting for the vendor to notice. That costs something. An agent kept off the open web does less useful work, and logging every action takes engineering time a pilot budget may not cover.