Altman on the end of patching, Hassabis on AGI, DeepSeek's usage surge

Sam Altman has quietly conceded something the security industry has resisted for decades: you cannot fix everything. At Stanford, and in remarks reported elsewhere this week, the OpenAI chief said he no longer believes software teams can patch every vulnerability that AI systems now surface. His proposed alternative is an AI-powered defensive shield rather than an endless race to close holes one at a time. I find this both refreshingly honest and a little convenient. It is honest because anyone who has watched a backlog of CVEs grow knows the arithmetic stopped working long ago. It is convenient because the company that sells the tools discovering the flaws is also positioning itself to sell the cure.

Still, the underlying point deserves to be taken seriously, especially given reports that a fresh wave of AI-discovered vulnerabilities knocked government websites offline. When finding bugs becomes cheap and fixing them stays expensive, attackers and defenders are no longer on equal footing. If you are building with AI, the practical lesson is to assume that something in your stack will be exploitable and to design for containment, monitoring and fast recovery rather than for perfection. Rhetorically, "patch everything" is dead. Whether an AI shield is a real architecture or just a slogan is the question I would press on next.

Meanwhile, Demis Hassabis is making a different kind of argument. A Wall Street Journal profile shows him pursuing faster science and drug discovery, and the piece asks the uncomfortable question of who ultimately benefits. By the way, that question matters more than the technology. A model that compresses years of drug development into months is only as valuable as the access, pricing and regulatory structures around it. Hassabis has also shifted his AGI timeline noticeably, suggesting it may arrive sooner than he previously thought. I take that more seriously coming from a researcher who has historically been measured than I would from a founder raising money, though a shorter timeline is still a forecast, not a fact.

The most telling number of the day, though, comes from usage rather than rhetoric. DeepSeek's V4.1-Flash-1017 processed 33.6 trillion tokens in a week, an 801 percent jump, putting it at the top of global usage rankings. A cheap, fast model winning on volume says something about where real demand sits: most developers are not chasing frontier benchmarks, they are chasing cost per useful answer. That is also why the Stanford and Berkeley work on TokenGate caught my eye. It targets prefill, the costly stretch before a model begins to respond in long-context tasks, and cheaper prefill reshapes the economics of agents that carry large amounts of context around. IBM's expansion of watsonx Orchestrate for managing agents across platforms points the same way, toward the plumbing that makes scaling practical.

So here is what I keep turning over. If AI makes both attack and defence cheaper, and cheap models dominate usage, does security end up as a race decided by whoever can afford the most tokens? I suspect the answer will shape enterprise AI strategy far more than any AGI timeline.