Patch the Planet: OpenAI and Trail of Bits secure critical open source

OpenAI and Trail of Bits launch Patch the Planet, using GPT-5.5-Cyber to secure 19 open-source projects like cURL, Python, and Go with human-reviewed patches.

OpenAI, through its Daybreak security initiative, and the company Trail of Bits are launching Patch the Planet, a program designed to help open-source maintainers secure the critical software components on which the rest depends. The approach combines AI-assisted vulnerability research, via OpenAI's most cybersecurity-focused models, including GPT-5.5-Cyber and Codex Security, with expert human review. The objective is not only to identify flaws but also to help fix them. HackerOne and Calif are joining for triage and disclosure.

Each collaboration starts with the maintainer's needs: researchers validate real problems, develop and test patches, then coordinate disclosure through the project's channels. A key safeguard is central to the program: security engineers review each finding before it reaches the maintainer, because cutting-edge models also produce many false positives that could overwhelm already overburdened teams, and maintainers maintain control over applied patches and disclosure. In the initial wave, nineteen critical projects, including cURL, Python, and the Go project, saw hundreds of bugs identified and dozens of patches already merged; more than thirty projects have since joined the program.

The findings cover all layers of the stack, from operating system kernels to browsers, with details remaining withheld as coordinated disclosure continues. The lesson the two partners are hammering home: with AI, finding bugs has become the easy part; the cost has shifted to everything that follows—confirming a vulnerability, correctly assessing its severity, writing a patch that the maintainer will accept, hardening the code, and orchestrating disclosure—which is precisely the work that a flood of AI-generated reports threatens to bury.