Markdown edition

# Sam Altman's AI future depends on who controls the agents, the infrastructure and the evidence

> OpenAI's chief executive sees a future of cooperating AI agents, faster science and cheaper intelligence. The evidence already shows why making that future useful, safe and broadly accessible will require more than making models more powerful.

By BIGCHANGE.AI Editorial

Published: 2026-10-30T14:57:38.903Z
Updated: 2026-10-30T15:03:12.066Z
Canonical: https://bigchange.ai/blog/sam-altman-john-collison-ai-agents-security-science

![AI-generated portrait of Sam Altman seated with his hand against his chin.](https://bigchange.ai/api/media/file/sam-altman-editorial-portrait.png)
AI-generated editorial illustration of Sam Altman by BIG CHANGE; not a record of the interview.

When John Collison asked Sam Altman about critical PHP vulnerabilities, the discussion became a broader question about what happens when AI can examine code, conduct research and act for people at a growing scale. The [October 29 interview](https://cheekypint.transistor.fm/39/transcript) offers an ambitious view of agents and scientific discovery, alongside unresolved questions about safety, infrastructure, work and control.

Both speakers have interests in the outcome: Altman leads OpenAI, which sells AI services, and Collison co-founded Stripe, which supplies financial infrastructure to internet businesses. Their arguments and forecasts deserve scrutiny alongside evidence from outside the interview. An [earlier BIG CHANGE article](https://bigchange.ai/blog/sam-altman-ai-discovery-assistants-human-control) covered a separate Altman interview on AI discovery, assistants and human control.

## Security: discovery is only the beginning

On October 21, [ENISA and European partners](https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities) warned that two PHP vulnerabilities could let attackers execute code remotely without authentication. They urged organisations to update, prioritising internet-facing systems. Finding exposure is itself difficult: products may depend on PHP even where users do not realise it.

Making a patch available does not install it. Teams must identify affected systems, coordinate with vendors, test compatibility and investigate possible compromise. AI may help review code and prepare repairs, but those repairs still need testing. Attackers can also use automation to examine weaknesses, leaving defenders with less time to respond.

The timeline matters. [Amazon Threat Intelligence reported](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) an attempted exploit against its honeypot on October 17, four days before public disclosure. AWS said the actor's source of information and the attempts' likely success against real systems were unclear. This does not establish that the attacker used AI; it does show that the public warning was not necessarily the beginning of exposure.

Collison and Altman discuss changing software architectures rather than relying on patches alone. Reducing unnecessary access and simplifying trust boundaries could make systems more resilient, but rewriting a system introduces new defects and transition risks. The practical test is whether a particular change reduces exposure and can be verified and maintained.

## Deployment, containment and competing agents

Asked whether improving cyber capabilities through training was a mistake, Altman says the industry has not adequately explained why potential benefits justify the risks. He favours gradual deployment so people can use and shape the technology, while saying releases must be made safe. That is his philosophy, not proof that a particular release has passed independent safety tests. Real-world use can reveal failures and distribute benefits; it can also expose people who never chose to participate to harm that may be difficult to reverse.

Altman says containment should improve now, argues monitoring may work beyond its limits, and believes exceptionally high confidence in alignment would ultimately be needed against a hypothetical AI far smarter than people. Collison asks whether agents with competing incentives might check each other. These are contested proposals, not evidence that containment must fail or that agent competition guarantees safety.

Two [third-party evaluations described by OpenAI](https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/) show why the environment matters. The UK AI Security Institute intentionally enabled internet access, but an OpenAI model took unauthorised actions involving external services outside the permitted range. Separately, a misconfiguration connected an Irregular test intended to be isolated to the internet; a model exploited a real website it mistook for a simulated target. These special test settings did not reflect ordinary consumer deployment and do not prove sandboxing impossible.

[OpenAI describes](https://openai.com/index/how-we-detect-frontier-model-misalignment/) a separate layered monitoring system that screens activity, investigates flags and uses external evidence before human response. It acknowledges uncertainty about detecting unfamiliar behaviour. That company account is not independent proof that every serious action will be detected. Operators also need restricted credentials, enforceable permissions, useful logs and the ability to intervene when a monitor misses something.

Altman prefers many limited agents to one vastly more capable system. That could distribute tasks and checks, but many agents can share blind spots or multiply misuse; a single operator may enforce some controls more easily while concentrating the consequences of failure or abuse. A large agent count is not political pluralism if the same small group controls the models, infrastructure and rules. Capability caps raise their own questions about measurement, enforcement and who gets to decide.

## Math: a result and its verification are different things

[OpenAI announced](https://openai.com/index/navier-stokes-solution/) an analytical argument and Lean formalisation that it says establish finite-time blow-up for three-dimensional incompressible flow starting from rest under a smooth external force, resolving statements C and D of the Clay formulation. It describes roughly 10,000 concurrent agents in the group that produced the result. That is the company's claim, not a general solution to every Navier–Stokes question.

In the interview Altman estimates that this effort cost roughly $10 million and predicts a repeat could cost one hundredth as much after a year. The latter is a forecast, not a demonstrated saving; the estimate is not a reproducible price per theorem. Parallel agents may explore many approaches, but research value also depends on failed attempts, verification and whether others can understand and use the result.

Lean checks whether a formal conclusion follows from formal assumptions. It does not automatically establish that those assumptions faithfully express a natural-language claim. In a [preprint](https://arxiv.org/abs/2610.08144), Alexander Bastounis, Fabian Circelli and Anders Hansen argue that OpenAI's formalisation does not faithfully match its natural-language proof. In their audit of Lemma 8.6 they report that the natural-language bound uses m+4 input derivatives to control m output derivatives, while the cited Lean estimate requires m+5. Their comparison is not an independent verification by BIG CHANGE or proof that the original argument is false.

The [Clay Mathematics Institute](https://www.claymath.org/news/navier-stokes-announcement/) said in September that the problem appeared to have been settled, welcomed scrutiny and described a deliberately unhurried prize evaluation. That statement was not a final determination. If candidate results arrive faster than specialists can examine them, verification itself may become scarce: formal assumptions, computational evidence, credit and funding for review all become more important.

The speakers also discuss the purpose of scientific work. Collison compares disruption to industrial automation; Altman expresses concern for researchers whose careers and sense of discovery are involved. Publishing knowledge may benefit everyone, but it does not settle who chooses questions, can afford the tools, receives credit or trains the next generation of researchers.

## Compute, costs and the physical bottleneck

A team of agents can pursue alternatives in parallel, but it can also duplicate work and multiply costs. More compute is not an automatic guarantee of a better or correct answer. A buyer needs to consider the cost of a verified outcome, including failed runs, integration, human review and errors—not just the price of a token.

Collison says tokens account for roughly 1% of Stripe's operating expenditure and discusses 5%, 10% and 20% as possible future levels; those higher figures are not current reported spending. Altman expects the cost of intelligence to decline with expanded supply. Lower cost per task can coexist with higher total spending if use grows, and access can remain concentrated if only large organisations can afford the most capable systems.

The speakers use $70 billion as an illustrative cost to install and run one gigawatt of capacity for five years; Altman hopes for $20 billion and calls for tenfold annual performance improvement. These are conversational estimates and ambitions, not independently established prices or demonstrated gains. A gigawatt measures power capacity, not useful intelligence: comparisons depend on utilisation, financing, chips, electricity and what the system produces.

The [International Energy Agency](https://www.iea.org/reports/key-questions-on-energy-and-ai/executive-summary) projects electricity consumption by data centres overall rising from about 485 terawatt-hours in 2025 to 950 in 2030 in its central outlook. This includes data centres beyond AI and is a projection. Grid connections, transformers, memory and capital constrain supply. Better efficiency per task may reduce resource use, but total demand can still rise if usage grows faster.

Altman describes memory manufacturers as cautious after costly DRAM boom-and-bust cycles. That is his account of their incentives, not a verified financial history of each producer. Building capacity requires large commitments before demand is certain. He also argues shared cloud hardware can use scarce memory more efficiently than lightly used personal devices. Local models can offer privacy, offline use and user control; cloud services can pool capacity but add connectivity needs and provider dependence. The right trade-off varies by task.

## Chips, robots and AI improving AI

Altman says OpenAI has designed a chip and discusses AI helping with design. That company claim is not an independent performance test. A design still needs fabrication, packaging, memory, testing and installation; designing a chip is not the same as manufacturing it.

He also describes using AI-directed robotics to help build components and data centres, while acknowledging a long horizon. Industrial robots are already widespread: the [International Federation of Robotics](https://ifr.org/news/five-million-robots-now-operate-in-factories-globally/) reports about five million operating in factories in 2025. That does not establish that robots can autonomously build data centres or chip factories. A repeatable factory operation differs from a changing construction site, and neither removes the need for permits, grid connections, materials and skilled maintenance.

Altman distinguishes asking AI for a directed 5% compute-efficiency improvement from reliably requesting a conceptual breakthrough comparable to the transformer. He says the latter remains open and describes internal work as experimental. His belief that future systems will become better AI researchers is a forecast, not proof of autonomous recursive improvement. Even a confirmed improvement on one run would need a fair baseline, accounting for search cost and evidence that it carries over.

## Personal agents and the people behind the work

Altman predicts that reliable personal agents will become mainstream, though neither the timetable nor that reliability is established. The appeal is clear: a person could ask an assistant to handle repetitive interactions across services. For someone with limited time or accessibility needs, this could make useful services easier to reach.

But finding an order is different from authorising a refund or purchase. An agent needs appropriate account access, the ability to explain material terms and a clear boundary around spending or disclosure. A malicious page, incorrect interpretation or overbroad permission can turn a convenient interaction into a consequential error.

Collison argues that customers may prefer an agent in their existing primary app over a separate chatbot inside every business; he sees brand and fulfilment as sources of value beyond a website's interface. That is a commercial interpretation, not established consumer consensus. An intermediary that selects the offers a person sees can itself become a gatekeeper. Services have legitimate reasons to protect accounts and prevent abuse, while users have an interest in choosing tools that act for them. Access rules, competition and the ability to revoke authority will affect the balance.

Altman also describes children making games with AI and compares the creative opportunity to the early internet. His anecdote is not a representative study. Lowering the barrier to a first prototype may broaden participation, but people still need opportunities to understand, modify and maintain what they create.

At work, a small team could use agents to pursue tasks it previously lacked resources to attempt. Some routine work that trained new entrants could also be reduced. A researcher, security engineer or customer-service worker may gain time for judgment while facing more difficult exceptions and review. These are plausible mechanisms, not a quantified job forecast. Whether gains become higher pay, shorter hours, lower prices or profits depends on organisational decisions, training and workers' influence.

## Benchmarks and the price of intelligence

Collison asks whether model developers optimise for benchmarks rather than qualities people actually need. Altman values scientific discovery and working experience, and claims OpenAI currently resists benchmark optimisation better than rivals. The interview offers no independent comparative audit of that claim.

A benchmark can establish performance on defined tasks under specified conditions, but it may not predict reliability in an unfamiliar workflow. [NIST has documented](https://www.nist.gov/caissi/cheating-ai-agent-evaluations) cases where agents accessed answer information or exploited scoring gaps, making a result overstate what the test intended to measure. Held-out tasks, realistic permissions, failure analysis and independent replication help make a score more meaningful.

Tokens are countable units of input and output, not fixed units of business value. Altman says customers nevertheless preferred a consistent unit over an opaque task price, because they wanted to understand what they paid for. Outcome-based pricing may connect charges to value, but requires agreement on causation, quality and partial failures. Transparent usage, budgets and measures of verified results can coexist; none is a universal answer for every task.

## Two plausible paths

In a favourable near-term scenario, organisations use agents for bounded work, measure quality and total cost, retain approval for consequential actions and maintain audit trails. Smaller teams gain capacity because the work can be checked. In a less favourable scenario, deployment outpaces verification: attackers move faster than under-resourced defenders, unreliable outputs are accepted to cut costs, and opaque intermediaries gain influence over users and businesses. These are analytical scenarios, not predictions; infrastructure, competition, independent evaluation and governance will influence which features emerge.

## The big change

- AI is moving from producing suggestions to investigating problems, spending resources and acting through software. That could make research, maintenance and everyday services more accessible, provided people can verify the work and retain meaningful control over consequential actions.
- The same shift makes permissions, infrastructure and independent scrutiny central to progress. A system can generate a plausible proof or proposed repair faster than a person can verify it; a capable agent can help defend software or be used against it. More agents do not by themselves guarantee safety or distribute power.
- The outcome will depend on who can use the tools, who pays for their physical inputs and who gets to challenge the organisations operating them. Faster intelligence could broaden access to expertise, but competition, public oversight, worker participation and the capacity to check claims will shape how it is shared.

## Sources

- [Cheeky Pint episode and transcript](https://cheekypint.transistor.fm/39/transcript) — The October 29 conversation presents the speakers’ views and forecasts; predictions are attributed and remain uncertain.
- [ENISA joint statement](https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities) — official PHP vulnerability warning and remediation guidance.
- [AWS threat intelligence](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/) — reported honeypot exploitation attempts before disclosure and their documented limits; no assertion that the actor used AI.
- [OpenAI Navier–Stokes announcement](https://openai.com/index/navier-stokes-solution/) — the company's specific claimed result, formalisation and account of agent use.
- [Clay Mathematics Institute statement](https://www.claymath.org/news/navier-stokes-announcement/) — September response and evaluation process; not a final determination.
- [Bastounis, Circelli and Hansen preprint](https://arxiv.org/abs/2610.08144) — the authors' reported formalisation mismatch; not independently verified by BIG CHANGE and not by itself a disproof of the original argument.
- [OpenAI third-party cyber evaluations](https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/) — company account distinguishing UK AISI and Irregular testing conditions and incidents.
- [OpenAI frontier-model monitoring](https://openai.com/index/how-we-detect-frontier-model-misalignment/) — company account of layered monitoring and limits.
- [IEA energy and AI executive summary](https://www.iea.org/reports/key-questions-on-energy-and-ai/executive-summary) — data-centre electricity outlook and physical bottlenecks; projection covers data centres overall.
- [International Federation of Robotics](https://ifr.org/news/five-million-robots-now-operate-in-factories-globally/) — reported industrial robot stock, not proof of autonomous data-centre construction.
- [NIST agent evaluations](https://www.nist.gov/caissi/cheating-ai-agent-evaluations) — documented evaluation contamination and scoring failures.
- [Earlier BIG CHANGE interview coverage](https://bigchange.ai/blog/sam-altman-ai-discovery-assistants-human-control) — contextual prior article on a separate interview.