A podcast clip did the rounds last week under the title "OpenAI's Co-Founder Says We Have Months Left". The co-founder was Greg Brockman, OpenAI's president, and the source was a post he published on 16 August called The Defender's Window. The hosts gave it the first eight minutes and then moved on to arguing about whether AI is a scam and what to make of a new Tencent model, which is a shame, because the eight minutes deserved the full half hour.
Brockman was not the first person to put a clock on this in 2026, and the clocks are measuring different things. They are worth separating, because the headline flattens them into one, and the flattened version is the one most people will have heard.
What was actually said, and by whom
In April, Anthropic announced Project Glasswing and said its Claude Mythos Preview model had found thousands of previously unknown high-severity vulnerabilities on its own, including a 27-year-old bug in OpenBSD and a 16-year-old one in FFmpeg that automated testing had passed over roughly five million times. Those were reported to the maintainers, and the announcement put no date on anything (Anthropic). The date came in May, when Dario Amodei told a financial services audience that organisations had "six to 12 months" to fix that backlog before models from other countries could find the same bugs (PYMNTS). So that clock is about who catches up to whom, and it is the one most often repeated as "six months to solve cybersecurity", usually without the second half of the sentence.
In July, OpenAI reported that two of its models, in a red-team test that deliberately ran with reduced guardrails and instructions to use "complex attack paths", took credentials, used a vulnerability nobody had catalogued, and reached Hugging Face's internal systems. OpenAI called it "an unprecedented cyber incident", and Clément Delangue, Hugging Face's chief executive, "an attack unlike anything we've seen before". Hannes Cools at the University of Amsterdam was less impressed, telling PBS: "It is a human decision to switch off specific safeguards. It's not an AI that goes rogue in that sense" (PBS). He has a point. People loosened the safeguards on purpose, and the model then did, unprompted, a chain of things that used to need a skilled human at a keyboard for a week, according to OpenAI's own account of it.
Then Brockman wrote the post. The opening line is the one the podcast read out: "In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable." His clock is different again. It is about open-weight models, the ones anyone can download, which he says now have cyber capability "only a few months behind the frontier" (Greg Brockman). Eleven days later OpenAI published an open letter making the same case, signed by more than 100 companies including Anthropic, Google, Microsoft, AWS, Cloudflare, Cisco, Visa and Mastercard (Bitdefender).
Gizmodo pointed out that three of the loudest voices here sell AI, which is fair. The Australian Signals Directorate does not, and its guidance this year, written for boards of directors and so sitting at the same altitude as the labs' advice, says frontier AI "has the potential to significantly reduce vulnerability discovery and exploitation timelines from days to hours while significantly lowering the skill and knowledge barrier for malicious actors", and that organisations "should enhance their cyber security fundamentals now" (ASD). Where the labs and the regulator differ is the date, and on the date ASD is the quietest of the four, which is probably the right amount of quiet for a regulator.
The advice is written for people with a security team
We think the labs are right about the direction and talking to the wrong room.
Brockman's post ends with ten recommendations. Run tabletop exercises. Deploy agentic coding tools to your security team. Integrate agent-based review into your CI/CD pipeline. Automate your detection triage. Apply for OpenAI's Trusted Access for Cyber programme. Every one of them assumes a security team and a development pipeline, and several assume an OpenAI contract.
A 30-seat accounting practice has none of that. It has Microsoft 365, a line of business app or two, and an MSP it pays monthly, and the MSP has 40 or 60 of those clients and a handful of engineers. The open letter mentions that audience once, when it asks governments to fund "hospitals, water utilities, and local authorities lacking independent preparation capacity", and then moves on to other things. So the question for this end of the market is narrower than the one the labs are answering. If the window is real, what does an SMB actually get attacked with, and what can its MSP do about it in the months available, with the people it already has?
What the attack looks like at 30 seats
Nobody is going to spend a Mythos-grade exploit on a 30-seat tenant. Frontier models raise the ceiling, and the Glasswing bugs are what that looks like: flaws that sat in hardened code for decades. The same models also make the cheap attacks cheaper, and cheap attacks are most of what a small tenant sees in a year. Guardz's numbers show what that looks like at the small end.
Guardz published its 2026 State of MSP Threat Report in April, built on 180 days of telemetry across the Microsoft 365 and Google Workspace tenants its MSP customers manage (Guardz). The sample is tenants already paying for security monitoring, so it is one vendor's customer base and, if anything, a flattering picture of the wider market, since the unmonitored tenants are not in it.
At any given moment, 89% of the SMBs in the dataset had at least one user with a confirmed compromised credential. Usually that means a staff password has turned up in a breach dump and is sitting on a list somewhere. Nobody has necessarily used it yet, and the point of watching is to catch the first time somebody does. Session hijacking, where the attacker steals a valid logged-in token instead of the password, grew 23% over the period. More than 114,000 successful sign-ins bypassed multi-factor authentication by coming in through legacy protocols that never prompt for it. In Microsoft 365, machine identities such as service principals, OAuth apps and system accounts outnumbered human users 25 to one, often with broad permissions and little oversight. And the single largest endpoint threat campaign, at 26% of detections, was abuse of the same remote monitoring tools the MSP uses to do its job, with ScreenConnect, Atera and MeshAgent named in the report.
Dor Eisner, Guardz's chief executive, put it this way: "Threat data shows that entry points haven't changed; attackers are still getting in through identity gaps, weak controls, and misconfigurations, just faster and at greater scale" (PR Newswire).
None of those techniques needs a frontier model. Credential stuffing and legacy-protocol logins are older than most of the people running them. What a model changes is the cost of running them against every tenant at once, and of chaining a stale credential to an OAuth grant to an inbox rule with no person in the loop. The weaknesses have been there in almost every tenant for years.
The MSP's version of the ten recommendations
Strip the enterprise assumptions out of Brockman's list and what is left for an MSP is familiar work. None of it is new. Most of it has sat on to-do lists for years, and the months the labs are talking about are roughly how much longer that stays affordable.
Start with identity, watched continuously across every tenant. The compromise begins at a login, so detection has to sit there: impossible-travel sign-ins, new inbox rules, OAuth consents, privilege changes, token replay. It has to run 24 hours a day across all 60 clients at once, including the ones on Google Workspace, where Microsoft's tooling does not reach.
The obvious objection is that Microsoft already sells this, and it does, partly. Entra ID P1 gives you conditional access, and P2 adds Identity Protection, which scores risky sign-ins and risky users. Those are good signals and most tenants should have them switched on. What Entra will not do for an MSP is act on the signal at two in the morning, and it will not tie the identity alert to the phishing email that caused it or the endpoint it landed on. Clients on Google Workspace get nothing from it at all. That is the gap Guardz is built to fill. Its identity threat detection covers Entra ID and Google Workspace, its managed detection and response layer combines agentic triage with a human SOC around the clock, and from one incident the team can suspend the user or revoke the token, and isolate the endpoint if it has got that far. The triage layer is itself AI, with the human SOC behind it for the cases the model gets wrong. If you already have Entra P2 and someone watching it overnight across every tenant, this job is covered. In practice a lot of MSPs have the licences already, and the overnight cover is the part that is missing.
Next, close the routes attackers log in through. Legacy authentication first, then unused OAuth apps and service accounts with more permission than they need. Microsoft started switching basic authentication off in Exchange Online in 2022, so the 114,000 sign-ins in the Guardz data are coming through the exceptions that survived, and a tenant review will find them. It is unglamorous configuration work, mostly done in the Entra and Exchange admin centres, and it closes the routes the numbers say are being used now.
Then assume one of them gets through, and make recovery boring. Brockman's warning is specifically about attackers who move faster than detection, and some will. Once prevention has failed, the fallback cannot depend on how quickly someone noticed, so it has to be a copy the stolen credentials cannot reach, which several vendors now offer in one form or another. Keepit is the one we distribute. It keeps its copy of Microsoft 365, Entra ID, Google Workspace, Salesforce and the rest on its own infrastructure, outside Azure, AWS and GCP, and Australian tenants can use its Sydney data centre. Jakob Østergaard, Keepit's chief technology officer, describes the design this way: "Administrative access cannot overrule or unconfigure the immutability as it is baked into the solution from the ground up" (Keepit). That is the property that matters when an attacker holds a global admin token, because a backup that lives inside the tenant is reachable with the same token, and usually from the same console.
Then test the restore, and put the result in writing. ASD's own line this year was that "the basics are still our most effective first line of defence", and a restore test is one of the basics, usually the one that has been on the list the longest.
If you already have a stack
Most MSPs already have tools, and this is a properties check. Nothing has to be ripped out to run it. For each client, ask two questions. Is there identity-layer detection with a human response, 24 hours a day, on this tenant? Is there a copy of this tenant's SaaS data on separate infrastructure that an admin token cannot delete, and when was it last restored? If both answers are yes, whoever the vendors are, there is nothing in this article that client needs. Otherwise the gap is the one the window is about, and it looks the same whether a person or a model finds it. The model just finds it sooner.
What CRS is doing about it
We distribute Guardz and Keepit together as the Protect and Recover bundle for exactly this reason. Guardz does the watching, across identity, email, endpoint and cloud data on every tenant, and Keepit holds the copy for the day the watching was too slow. The two run on separate infrastructure, on purpose, and that is most of the reason we sell them as a pair.
Guardz is priced per seat per month and Keepit per user per workload. Our pre-sales engineers scope both against the actual tenant, the real user count, workloads and licences, so the quote matches what is there, and we support partners across Australia, New Zealand, Fiji and PNG. If you look after SMB clients and want to see where they sit against the Guardz numbers above, a Guardz trial runs for 14 days with no card. If you want the whole stack priced for a specific client base, talk to our team.