“They are already a target for attack, and as long as they are successful they will continue to be; if they have direct access to user devices, the risks of them getting hacked will increase, and the spoils of war for the attackers will increase, since it enables essentially infinite mischief (e.g., draining bank balances, stealing credit card numbers, placing fraudulent transactions, extortion based on private photos, holding devices for ransom, and so on).”
Our reading, the sentence that was checked:
If OpenAI gains direct access to user devices, the risk of it being hacked and the rewards to attackers will increase.
Assessment: Unresolved No deadline stated on 2026-10-29 Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, What Could Possibly Go Wrong with Sam Altman’s New Ambitions?, paragraph 16.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-what-could-possibly-go-wrong-with-09f7ef-a1
We recorded 23 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-29. The source may have been edited after 2024-02-09. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Conditional forecast
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No deadline stated
- Deadline state on 2026-10-29
- No deadline stated (the release’s reference date)
Conditions
- if OpenAI has direct access to user devices (antecedent, stated by the speaker)
From the speaker
- if they have direct access to user devices
- the risks of them getting hacked will increase
- the spoils of war for the attackers will increase
Our interpretation
- Direct access means OpenAI software can operate on a user's computer, within whatever permissions the user grants.
- The comparison is with otherwise comparable software without device access. Both compromise risk and the resources accessible to attackers must increase.
- The surrounding discussion concerns OpenAI software and its users, but 'them getting hacked' could also mean OpenAI's central infrastructure.
Counts as supported if: After device access becomes available, comparative security evaluations or documented attacks show that this access creates additional compromise opportunities and increases attackers' access to valuable user resources.
Counts as contradicted if: Comparable evaluations show that device access does not increase compromise opportunities or attacker access to valuable resources under the relevant deployment conditions.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Did the forecast come true?
Outcome: Unresolved
The record was checked, and the evidence available by the cutoff does not settle it.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No deadline stated
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
The condition occurred: OpenAI released software operating on users' computers. Researchers subsequently demonstrated an agent-enabled data-theft path in Atlas. That supports Marcus's security concern, but the records do not settle both comparative predictions. Product safeguards also limit access. No decisive event establishes the entire claim under its ambiguous meaning of getting hacked.
Limitations
- The research demonstrates a controlled attack, not observed criminal losses.
- The claim gives no baseline, deadline, or risk measure.
Evidence (3 items)
Supports the claim: OpenAI,
Codex CLI
Why it matters here: The announcement describes an agent operating directly on the user's computer with access to local code. This establishes device access, without implying unrestricted access.
- Publisher
- OpenAI
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Context only: University of Washington,
ChatGPT Atlas in Agent Mode
Why it matters here: Researchers demonstrated agent-assisted theft across website boundaries in controlled experiments conducted in January and February 2026. This supports the proposed mechanism, but does not establish the overall change in OpenAI's compromise risk.
- Publisher
- University of Washington
- Kind of source
- Independent measurement
- Describes events of
- Public from
Context only: OpenAI,
still carry risk
Why it matters here: OpenAI acknowledges data theft and unintended-action risks. The same discussion specifies restrictions on filesystem and other-app access, plus monitoring and logged-out operation, limiting the inference of unrestricted attacker access.
- Publisher
- OpenAI
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
What would settle it
A reproducible comparison of otherwise similar OpenAI systems with and without device access, measuring compromise opportunities and the valuable resources reachable after compromise.
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, What Could Possibly Go Wrong with Sam Altman’s New Ambitions?
They are already a target for attack, and as long as they are successful they will continue to be; if they have direct access to user devices, the risks of them getting hacked will increase, and the spoils of war for the attackers will increase, since it enables essentially infinite mischief (e.g., draining bank balances, stealing credit card numbers, placing fraudulent transactions, extortion based on private photos, holding devices for ransom, and so on).
- Where
- paragraph 16
- Published
- 2024-02-09
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-what-could-possibly-go-wrong-with-09f7ef-a1: Current. Outcome: Unresolved. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment marcus-what-could-possibly-go-wrong-with-09f7ef-a1.