Fouad Matin

Fouad Matin is an OpenAI security engineer and the co-founder and former chief executive of Indent, an enterprise access-control company. His work tackles a central problem of autonomous AI: giving agents enough access to accomplish useful work while preventing them from exposing data, compromising systems, or taking consequential actions without oversight.

Matin previously worked at ClassDojo and Segment and helped build civic-technology projects including VotePlz and Help Users Vote. His voting-related work included privacy-conscious polling-place and ballot tools developed with Vote.org. His public GitHub profile documents affiliations spanning civic software, customer-data infrastructure, and security.

At Indent, Matin developed time-bound access controls that allowed employees to request and approve temporary permissions through familiar tools such as Slack. His practical diagnosis was that excessive privileges often result from cumbersome security procedures: when obtaining appropriate access becomes difficult, organizations leave broad permissions permanently enabled. In a 2023 interview on cloud security, he made the case for usable least-privilege systems and careful stewardship of customer data.

After joining OpenAI’s security team, Matin moved into agent robustness and control, contributing to Codex and Codex CLI. AI Engineer World’s Fair listed him as OpenAI’s Cyber Team Lead for its 2026 conference.

Security principles for increasingly capable agents

• Code execution extends beyond programming. Agents can write and run code to crop images, extract text with optical character recognition, or solve other multimodal problems. Their security boundaries must therefore cover autonomous tool use broadly, not only software-development workflows.

• Prompt injection and data exfiltration are connected risks. Untrusted instructions embedded in documentation or GitHub issues become especially dangerous when an agent can read sensitive files and send network requests. Matin argues that model safeguards must be reinforced by enforceable restrictions on what the surrounding system permits.

• Operating-system sandboxing provides concrete boundaries. His approach combines isolated containers, restricted networking, domain allowlists, and local controls including macOS Seatbelt and Linux seccomp and Landlock. The open-source Codex repository exposes the broader implementation ecosystem, while his AI Engineer session explains the security tradeoffs behind these mechanisms.

• Human oversight should target consequential actions. Agents need room to run tests and complete ordinary work independently, but sensitive operations, unfamiliar dependencies, and final code changes warrant meaningful review. Excessive approval prompts undermine security by encouraging indiscriminate confirmation.

• Trusted Access for Cyber directs advanced capabilities toward defenders. Matin has advocated expanding access for authorized cybersecurity practitioners. In a May 2026 update, he described a limited GPT-5.5-Cyber preview for critical-infrastructure defenders and distinguished it from Trusted Access for developers finding and fixing vulnerabilities.