OpenAI patched a thousand Linux vulnerabilities without human sign-off

OpenAI's engineering team built and ran a system that found and fixed over a thousand security vulnerabilities across its Linux fleet without a human approving each change. The system worked end to end: it identified a weakness, wrote a fix, tested it, and applied it. No engineer reviewed individual patches before they landed.

That shift in where human judgment sits is the real finding. In most high-stakes software work, a person reviews and approves before a change goes out. Here, the agent acted and the human reviewed the results afterward, if at all. The question for any team building something similar is whether the approval step moved to the right place, or whether it disappeared.

For designers of agent products, this is evidence that the approval interaction does not always belong before the action. It can move to the design stage, to the boundary conditions, or to a spot check after the fact. The harder question is how a human knows when something went wrong, and what they can do about it then.