Hook:
10 million weekly active users. 5x growth in a quarter. A single metric has the market buzzing about OpenAI's Codex and ChatGPT Work agents. But let me strip away the PR gloss. This isn't a victory lap for AI utility. It's a 10-million-user stress test of a system that has never been audited at the code level. And the industry is celebrating blind faith as product-market fit.
Context:
OpenAI announced that its two specialized agent products—Codex (a programming agent) and ChatGPT Work (an office productivity agent)—have collectively reached 10 million weekly active users. The trigger for this surge was a ingenious growth hack: for every 1 million new users, OpenAI resets the usage caps for all existing users. This turns user acquisition into a collective good, creating a viral feedback loop. The result? A user base the size of a small country is now trusting OpenAI's black-box code to write production software and manage sensitive business workflows.
But here's what the celebratory headlines won't tell you. These agents are executing arbitrary code, reading your emails, editing your contracts, and generating logic that may end up in financial infrastructure. They are effectively smart contracts without a formal audit. And I've spent the last seven years dissecting exactly that kind of systemic risk.
Core Analysis: The Unaudited Execution Layer
Let's talk about what 10 million weekly active users actually means in terms of attack surface. Every interaction with Codex is a prompt injection vector. Every workflow in ChatGPT Work is a composability chain that can be exploited.
Code is law, but audit is mercy. In DeFi, I've seen $200 million evaporate because a single integer overflow in a leverage calculator was missed. The 2x Capital audit I led in 2017 caught exactly that bug—one line of code that would have drained user funds. Now imagine that same vulnerability in an agent that generates code for a DeFi protocol. The agent doesn't have a formal specification. It has a probabilistic model trained on GitHub repos, many of which contain bugs. Codex is effectively a stochastic compiler that produces untested executables at scale.
Composability is leverage until it is liability. The true power of these agents is their ability to chain actions: read a spreadsheet, query a database, send an email, deploy a contract. Each connection is a trust boundary. In my 2020 risk assessment for Compound, I modeled how flash loan attacks could cascade through oracle delays. The same principle applies here: a single compromised plugin or a cleverly crafted email could trigger an agent to execute a catastrophic sequence of actions. The agent's 'execution environment' is not a sandboxed VM; it's your actual file system, API keys, and smart contract deployer accounts.
The 'Growth Hack' Masking Technical Debt
Resetting usage caps per million users is a clever social contract. But it reveals something else: OpenAI is trading usage limits for user growth because they know their inference costs are dropping faster than they can price. That's good for adoption, but it means the unit economics are still unproven. More importantly, it means the safety R&D budget is being spread thinner across a rapidly growing user base.
Blind faith is the only true vulnerability. Every user who accepts the terms of service without reading the code (because they can't—it's proprietary) is signing a blank check. In blockchain, we have a term for this: "trust me, bro."
From my analysis of the Terra/Luna collapse, I published a post-mortem that traced the failure to a feedback loop in monetary policy that the code did not account for. The same pattern applies here: OpenAI's alignment research assumes user intentions are rational and benign. But real-world agents will face adversarial inputs, edge cases, and malicious actors. The 10 million user milestone does not validate the product; it merely increases the blast radius of the first major exploit.
Contrarian: The Real Bottleneck Is Not Adoption, It's Formal Verification
The contrarians will argue that 10 million users is unassailable proof of product value. I say it's proof of a vulnerability waiting to be discovered.
Consider this: OpenAI is building a platform on top of models that are fundamentally probabilistic. Every output is a guess, statistically. Yet they are asking users to treat those outputs as deterministic instructions for their business. That's a category error. In my work with BlackRock's ETF infrastructure team in 2024, I insisted on fraud proofs and liveness guarantees for every Layer-2 settlement. The same principle should apply here: every agent action should be verifiable, auditable, and reversible. OpenAI provides none of that.
The blind spot is the assumption that 'more users = more data = better safety'. That's false. More users mean more adversarial diversity. In DeFi, we learned that high TVL attracts sophisticated attackers. The same will happen here. The first major agent-related exploit will not come from a nation-state; it will come from a grad student who finds a prompt injection that makes the agent transfer all funds to a wallet they control.
Royalties are social contracts enforced by code. If OpenAI's agents are trained on copyrighted code and then generate similar code, the liability will be immense. The 10 million users are creating a dataset that will inevitably contain litigious content. The company is betting that the copyright fair use doctrine will protect them. I'm betting that a single lawsuit could shatter that assumption.
Takeaway: The Coming Audit Mandate
Infinite yield curves break under finite scrutiny. OpenAI's growth curve is steep, but the scrutiny is just beginning. Regulators, enterprise clients, and eventually insurance underwriters will demand formal verification of agent behavior. The question is not whether there will be a major security incident—it's when. And when it happens, the industry will pivot from growth-at-all-costs to security-first architecture.
Trust no one, verify everything, build twice. That's the only safe way to build on top of any AI agent. I've been saying this since I audited my first smart contract. The market is celebrating user numbers. I'm watching for the first exploit. When it comes, there will be a scramble to retrofit the kind of code-level verification that smart contracts have had for a decade.
Code is law. Audit is mercy. And right now, OpenAI's agents are operating outside the law.