OpenAI's security fix comes with a 20% price tag
Issue #018 · 4 min read
OpenAI's security fix comes with a 20% price tag
Plus: Cursor takes on GitHub, Asana's five-year project in two weeks, and teen mode arrives
The big story
Remember the OpenAI agent that hacked Hugging Face? The bill just came due.
OpenAI is rolling out new monitoring after that breach — more checks on what its models are doing during training, tighter alignment work, more security review before models ship. That's The Verge and TechCrunch, both covering the same announcement.
Here's the number that actually tells you something. Overhead will rise 20% for some workloads, because of an expanded multistage chain-of-thought monitoring system — that's The Register.
Watching a model think, step by step, costs compute. A lot of it.
OpenAI frames this as pacing model development against "cyber-critical capabilities" — models getting good enough at writing exploits that the safety net has to scale with them, per OpenAI's own post.
For a PM, the read is simple. If you're building on frontier models and your unit economics assumed today's inference cost, go check that assumption. Security isn't free, and this time the invoice has a percentage on it.
What shipped
Cursor is launching a code-hosting platform to compete directly with GitHub. TechCrunch frames it as Cursor capitalizing on developer frustration with GitHub. Worth watching less for the product itself and more for what it signals: the AI coding tools are done being clients to someone else's platform. They want the whole stack.
Asana says it replaced five years of planned engineering work in two weeks, using OpenAI Codex. The project — swapping out an outdated testing system — cost about $12,000, according to OpenAI's writeup. Take the "five years" framing with the skepticism it deserves; it's OpenAI's customer story, not an independent audit. But the shape of the claim — a scoped, well-understood migration compressed from years to weeks — is exactly the kind of work agentic coding tools are actually good at right now. If you own a similarly gnarly legacy test suite, this is the kind of project to pilot one, not the kind to bet the roadmap on yet.
ChatGPT for Teens is out, with parental controls and content protections built in. OpenAI's own post is here; TechCrunch makes the sharper point — teens have been using ChatGPT for years already, so this is retrofitting safety onto an existing habit, not getting ahead of one. If your product has any teen-adjacent usage you haven't instrumented for, this is a reminder that regulators and press notice the gap eventually.
Skipped this time: a stack of GitHub and Vercel changelog entries (JetBrains policy controls, OAuth token refresh, an Instagram chat adapter) — useful if you own that specific integration, not news for most PMs.
What I'd actually do this week
Check your inference cost assumptions. If you're on a frontier model and haven't priced in security-driven overhead, do the math before your next roadmap review, not after the bill arrives.
Read the Asana case study skeptically, then try a scoped pilot. Pick one bounded, well-defined legacy migration — not your core product — and time-box an agentic coding tool against it. You'll learn more from the failure modes than the marketing page will tell you.
If you have any teen or young-adult users, go look at what OpenAI actually shipped for controls. Not to copy it, but because "we didn't think about this until the press did" is a bad place to be standing next year.
Reply and tell me what broke when you tried any of this.
Tools mentioned
- OpenAI: pacing model development for cyber-critical capabilities
- Cursor's new code-hosting platform
- Asana + OpenAI Codex case study
- ChatGPT for Teens