Good fences make good partners

The story broke on September 18th, but in July, 3 security researchers from Hacktron AI broke into OpenAI in under 72 hours for less than $3,000 in Claude tokens. How did they do it? Through OpenAI's community forum, which runs on Discourse. They went through an unpatched flaw in Discourse's image processing software and a misconfigured "Sign in with OpenAI" integration that turned forum takeover into employee logins. They opened a code change in OpenAI's private repository to show that they were really inside and reported everything to OpenAI. OpenAI applied a fix within a day and paid them a $6,500 bounty.

I write about partnerships, the importance of clear boundaries and the damage that blurred lines or undefined areas can cause. This vulnerability was exposed in the handshake between OpenAI and Discourse, because no one explicitly owned the boundary. OpenAI's bug bounty excluded Discourse explicitly, and Discourse has no control over OpenAI's identity system and how it treats different logins. When a boundary like this fails, partner agreements define what can be done about it.

Also in July, an OpenAI evaluation agent escaped its test environment and got inside Hugging Face's production systems. Hugging Face then had to rebuild about a third of its infrastructure. Unfortunately, its suppliers' license terms stopped it from using leading closed AI models to defend itself, so it fought back against the OpenAI agent with an open-source model. Again, contracts decided how it could defend itself. Just weeks later, its CEO called Jensen Huang, and Nvidia is now buying Hugging Face for about $12 billion. A partner boundary failure ended in the sale of the company.

For B2B SaaS companies, partnerships show up everywhere: in your infrastructure agreements, in your marketplace presence, and in your supplier chains. There are ~32,000 MCP connectors today that let AI agents plug into software, which can create vulnerabilities between your company and someone else's. This doesn't mean that you should shut yourself off from partnerships, because partnerships are how distribution works nowadays, and without them, you'll lose out to your competition and won't be able to scale. Just this month, all three major cloud marketplaces (Microsoft, Google, and AWS) put AI into their marketplace buying path.

Clearly defining ownership will protect your partnerships and your business, and understanding boundaries on Day 1 will allow you to create systems that protect you before a crisis hits (as Hugging Face found out post-mortem). It's also really important to have and understand change of control clauses, as OpenAI just used one to cut off Cursor within just days of its parent company being acquired.

Press releases are always exciting, but it's the boring stuff that protects you. Having good, clear boundaries and ownership can make or break businesses. Robert Frost's neighbor was directionally right, and I'll leave you with his poem that came to mind when I read about the breach today:

Mending Wall (Robert Frost)

Something there is that doesn’t love a wall,

That sends the frozen-ground-swell under it,

And spills the upper boulders in the sun;

And makes gaps even two can pass abreast.

The work of hunters is another thing:

I have come after them and made repair

Where they have left not one stone on a stone,

But they would have the rabbit out of hiding,

To please the yelping dogs. The gaps I mean,

No one has seen them made or heard them made,

But at spring mending-time we find them there.

I let my neighbor know beyond the hill;

And on a day we meet to walk the line

And set the wall between us once again.

We keep the wall between us as we go.

To each the boulders that have fallen to each.

And some are loaves and some so nearly balls

We have to use a spell to make them balance:

‘Stay where you are until our backs are turned!’

We wear our fingers rough with handling them.

Oh, just another kind of out-door game,

One on a side. It comes to little more:

There where it is we do not need the wall:

He is all pine and I am apple orchard.

My apple trees will never get across

And eat the cones under his pines, I tell him.

He only says, ‘Good fences make good neighbors.’

Spring is the mischief in me, and I wonder

If I could put a notion in his head:

‘Why do they make good neighbors? Isn’t it

Where there are cows? But here there are no cows.

Before I built a wall I’d ask to know

What I was walling in or walling out,

And to whom I was like to give offense.

Something there is that doesn't love a wall,

That wants it down.’ I could say ‘Elves’ to him,

But it’s not elves exactly, and I’d rather

He said it for himself. I see him there

Bringing a stone grasped firmly by the top

In each hand, like an old-stone savage armed.

He moves in darkness as it seems to me,

Not of woods only and the shade of trees.

He will not go behind his father’s saying,

And he likes having thought of it so well

He says again, ‘Good fences make good neighbors.’