SentinelOne: OpenAI Models Do 4–6 Weeks of Reverse Engineering in 8 Hours

Gregor Stewart of SentinelOne said that the cyber capabilities of OpenAI models reach human level in reverse engineering: work that takes a top researcher four to six weeks takes the AI about eight hours. Counting working time on a 40-hour week, that is 160–240 hours versus eight, a speedup of roughly 20–30x. The source is both a vendor and a partner: the video was published on OpenAI's channel.

What exactly gets faster

The task is reverse engineering, meaning the analysis of malicious code. From a compiled file, an analyst works out what the code does, how it hides, and what it communicates with. It is one of the most labor-intensive tasks in security. Few specialists can do it, and every hour of their time is expensive. As a result, teams have to choose which samples deserve in-depth analysis. The rest sit in a queue or are never examined at all.

Stewart frames it in terms of economics: "This is the kind of intelligence we simply couldn't afford before." Speed alone is not the point here. When deep analysis becomes dozens of times cheaper, the threshold for "is this sample worth the time" shifts, and samples that used to be filtered out get analyzed.

What this gives a security team

SentinelOne names three effects:

• more malware samples analyzed with the same staff;
• the ability to link related threats: shared code, infrastructure, and techniques across different families;
• a clearer picture of how attacks evolve over time.

The third point follows from the first two. The more samples are analyzed down to the level of their logic, the easier it is to notice that three "different" tools were written by the same team or grew from the same codebase. Such connections often slipped through simply because no one ever got to as many as half the samples.

What the material leaves out

The source is thin: a short description of the video and a link to a case study on OpenAI's website. Several questions remain open:

• which model or system was actually used;
• on which samples, and by what criterion, "human-quality" output was determined;
• whether the eight hours is pure machine time or includes review by an analyst;
• what the error rate is and how much human oversight is needed after the AI.

The last point is critical. In reverse engineering, a wrong conclusion about a sample is worse than no conclusion: it can send an investigation in the wrong direction or create a false sense that a threat has been dealt with. The "8 hours versus 4–6 weeks" comparison is valid only if the results are comparable in depth and accuracy, and the published material gives no way to check that.

What teams can do

If you lead threat research or a SOC, don't carry this figure over to your own work. Test it on your own data instead. Take several samples your analysts have already worked through and run them through an AI assistant. Compare the output against your reference analysis for completeness, errors, and time spent on verification.

Separately, assess what has piled up in your queue of unanalyzed samples. That is where AI can help most, because there was no human time for that work at all. And build mandatory human review into the process: a 20–30x speedup is useful as long as the conclusions can be confirmed quickly.

For the market, the signal is this: security vendors are starting to talk about AI in terms of the cost of expertise rather than interface convenience. There are no independent measurements yet, and until they appear, SentinelOne's figure should be read as a claim, not a measured result.