AI news videos

OpenAI Says Block Got A Proposed Patch In 18 Minutes

OpenAI published a customer story on October 14, 2026 about Block, the company behind Square, Cash App and Afterpay, and its security team. Everything below comes from that page.

Watch on YouTube

Transcript

Sources

Every claim in this video comes from the top ranking coverage of this topic. The claims and where each one came from:

• Line-by-line backing for every narrated sentence, drawn only from the source page text. Hook sentence one, OpenAI says an automated patch arrived in eighteen minutes: backed by the stat callout 18 Minutes from submitting a high-level vulnerability to an automated proposed patch, and by the red team paragraph line that in recent red team exercises the time from submitting a high-level vulnerability to an automated proposed patch was 18 minutes. Hook sentence two, its page describes defenders at Block: backed by the who-is-Block paragraph that at Block, the company behind Square, Cash App, and Afterpay, the security team leverages the OpenAI Defense Factory, and by the CISO line that defenders are able to keep up with the rapid pace of AI adoption. Scene one sentence one, bug reviews took weeks: backed by the body line that projects like reviewing a software bug or parsing a log would take days or weeks to complete. Scene one sentence two, Block now needs hours: backed by the line that with AI systems including OpenAI Daybreak, Block is taking just hours to do work that used to take weeks, and by the statement that a human still validates every result. Scene two sentence one, detection replays span seven months of telemetry: backed by the detection tuning paragraph that the team can now replay a proposed detection change against seven months of production telemetry in under an hour, and by the matching stat callout of under one hour. Narration speaks only the seven months figure and leaves the sub-one-hour callout on screen so that a single number is voiced in that scene. Scene two sentence two, that check rarely happened before: backed by the same paragraph, which says the work used to mean requerying hundreds of old cases by hand and often it rarely happened in practice since it was so time-consuming. Scene three sentence one, Block stopped defaulting to the newest model: backed by the CISO quote that we used to use the latest model, but you don't need to do that anymore. Scene three sentence two, tasks get different models: backed by the remainder of that same quote, that it has been a learning experience to choose different models for different tasks, and by the model routing paragraph that Block's security harness is built on top of Daybreak to help route tasks to the right model. Scene four sentence one, six hundred analyst hours returned each quarter: backed by the what-is-next paragraph that detection and response work alone has handed back roughly 600 analyst-hours per quarter that used to go toward triaging false positives, and by the matching stat callout. Scene four sentence two, analysts moved to deeper investigations: backed by the following line that with that time back, the team now spends more time on deeper investigations and building more automation responsibly. Scene five makes no factual claim about the company; it is our standard disclosure and carries the required wording verbatim. Claims deliberately left out for lack of support, each named on a NOT PUBLISHED line on screen: no dollar cost or contract value, no security team headcount, no baseline for either 50 percent figure, no count of vulnerabilities found or fixed, no breach or incident disclosure, no methodology or audit for any figure, no date for the red team exercise, no name for the campaign that was taken down, no false-positive rate, no model pricing, and no Daybreak version. No release, launch or availability claim is made, because the page announces none. Voice safety notes for the audit: exactly three numbers are spoken. Eighteen is spoken in the first hook sentence, seven is spoken in the first sentence of scene two, and six hundred is spoken in the first sentence of scene four. No two numbers appear in the same sentence, and no two appear in adjacent sentences, since at least three number-free sentences separate each pair. The 1,100 analyst-hour figure and both 50 percent figures are shown on screen only and never spoken, so the two analyst-hour figures are never voiced in the same or adjacent scenes. No idiom, metaphor or figure of speech appears in narration, and the source phrase about fighting fire with fire is used nowhere in this file. No multi-item list appears in narration; the red team attack chain appears only in scene one onscreen text. No dotted domain brand is spoken, no hyphenated compound is spoken, and the word agentic does not appear.(Provenance note, not a real video title. The single source for this script is OpenAI's own customer story titled How Block is building AI-powered security with OpenAI technology, published at https://openai.com/index/block-ai-powered-security and captured on October 14, 2026, the same day this Short was produced. The page sits inside OpenAI's customer stories template and carries the metadata fields Company size: Enterprise, Region: North America, Industry: Finance and Technology, and Products: Codex. It also carries two Contact sales buttons and a closing marketing block stating that more than 1 million businesses around the world are achieving meaningful results with OpenAI, alongside a Keep reading rail of sibling customer stories for SentinelOne, 1Password and Ramp. That combination makes the page vendor marketing about a vendor customer. It is not a news report, it is not an engineering disclosure, and it is not a product launch. The scorer rated it 84 HOT with no launch-verb credit, which is the signature of a no-event piece, and nothing on the page was reviewed by anyone outside the publisher and the customer. The only named human source is James Nettesheim, Chief Information Security Officer at Block, who is the customer's own executive quoted inside the vendor's page, so every word of his is promotional testimony rather than independent confirmation. Corroboration is none. The research step searched YouTube for supporting material and retrieved zero of five candidate transcripts, because the installed yt-dlp build on this host cannot fetch captions. The dated timeline probes that did return were unrelated third-party commentary videos about artificial intelligence in general, so no fact in this script rests on them and not one of them is cited anywhere in this file. No second outlet carried these figures at the time of writing, and no auditor report, regulator filing or incident record was available against which to check any analyst-hour or percentage claim. Region is listed as North America, so the regional screen is clean. Because of all of the above, every factual sentence of narration names its attributor out loud, a different attribution phrase is used in each sentence, and the final scene states plainly that OpenAI published this about its own customer and its own products, that the figures are self reported and not independently verified, and that there is no product launch here. The products named on the page, OpenAI Daybreak and Codex, already existed before this page and no release, availability or announcement date is narrated anywhere.)