What Changed: A New Initiative to Support Open Source Maintainers
OpenAI has launched Patch the Planet, a Daybreak initiative built with Trail of Bits, to help maintainers strengthen the critical open-source software the world relies on. The program pairs AI-assisted security research using OpenAI’s most cyber-capable models with expert human review, aiming not just to identify vulnerabilities but to help patch them.
The core problem: AI is accelerating vulnerability discovery, but discovery alone does not protect users. Many maintainers are already being asked to sort through more reports, more quickly, with the same limited time and resources. Patch the Planet is designed to reduce that burden, not add to it. Security engineers review findings before they reach maintainers, work with projects to develop patches and tests, and build reusable workflows that help teams continue improving security after the first fixes land.
Initial participants include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python, and python.org. These projects support widely used networking, cryptography, software supply chain, and language infrastructure, where stronger security can benefit a broad range of downstream products and services. Additional projects will join in future rounds.
How It Works: Collaboration and Human Review
Each engagement under Patch the Planet begins in consultation with the maintainer. For each collaboration, security engineers work with maintainers to understand each project’s needs, preferences, and where additional security effort would be most useful: vulnerability validation, patch development, CI/CD improvements, or longer-term security engineering. Once aligned, researchers investigate potential vulnerabilities, validate meaningful issues, develop or refine patches, support testing, and coordinate disclosure through the project’s established channels.
Security researchers are equipped with frontier models as well as Codex Security to support analysis, patch development, testing, and documentation. Participating projects receive access to ChatGPT Pro, conditional access to Codex Security, and API credits for core open-source development, maintainer automation, and release workflows. Trail of Bits has developed AI-assisted workflows for deduplication, triage, and patching that projects can run with this support.
A key principle: maintainers remain in control of what patches are deployed and how disclosure is handled. The program is designed to preserve their agency over how changes land.
Early Results: From Weeks to Days
Trail of Bits has dedicated security engineers to work full-time with Codex and GPT-5.5-Cyber across 19 open-source projects, and has already identified hundreds of security issues and merged dozens of patches, with many more still undergoing coordinated disclosure.
The initial sprint also produced reusable security infrastructure: fuzzing harnesses, historical-CVE analysis pipelines, differential-testing systems, threat models, expanded test suites, and workflows for deduplication, false-positive filtering, severity correction, and patch generation. Some project-specific details will be shared later as testing, remediation, and coordinated disclosure progress.
A few early examples show what the team was able to build and find:
-
A fuzzing lab in less than a day. Trail of Bits engineers used repeated Codex /goal runs with GPT-5.5-Cyber to build an entire fuzzing lab covering dozens of entry points, variant builds, platforms, and novel test seeds. Engineers set the objectives and refined the prompts; the system then used coverage feedback to keep expanding into new surfaces, target edge cases, and filter weak or invalid candidates. The completed setup took less than a day. Trail of Bits estimates that building the same lab manually would ordinarily take at least several weeks.
-
A reusable pipeline for finding variants of known vulnerabilities. The team built an end-to-end system that ingests historical CVEs, extracts relevant vulnerability patterns, searches target codebases for related flaws, and sends candidate findings through specialized judging agents. The pipeline deduplicates results, filters likely false positives, and routes the strongest evidence to security engineers for manual confirmation. This turns years of public vulnerability history into a repeatable search strategy that can be applied across projects.
-
Differential testing in days instead of weeks or months. Different implementations of the same protocol should usually behave the same way under the same inputs. When they diverge, one may contain a bug. Applying this idea at scale is normally difficult because engineers must write custom shim and glue code connecting each implementation to a common test harness. Codex generated and iterated on that code, allowing multiple implementations to be fuzzed against one another and their behavioral differences investigated. The team reached high-signal results within days, compressing work that has historically taken weeks or months.
-
Testing software against the behavior its specifications promise. The teams used Codex to develop threat models, attack taxonomies, invariant tests, and property-based tests grounded in project specifications and RFCs. These methods exposed notable differences between intended and actual behavior while leaving projects with broader test coverage, stronger documentation, and improvements to CI/CD and software-supply-chain tooling.
Crucially, security engineers reviewed every finding before it reached a maintainer. While frontier AI models are highly capable of finding vulnerabilities and patching them, they also produce a high volume of false positives that can contribute to the already overwhelming backlog maintainers are facing. Patch the Planet solves for this by having dedicated Trail of Bits researchers reproduce the evidence, check findings against project-specific documentation and threat models, remove duplicates, reassess severity, and prioritize confirmed vulnerabilities for remediation. They also develop and submit patches in accordance with maintainers’ preferences.
Broader Findings: Across the Software Stack
Patch the Planet builds on a broader body of Daybreak work showing how frontier models can help defenders find, validate, and remediate serious vulnerabilities in widely used software. The findings span every layer of the software stack, with many more still in the disclosure process.
Operating systems:
- Linux Kernel: GPT-5.5-Cyber identified security-relevant components across more than 30 million lines of code, flagged potential security issues, and then validated them dynamically, generating 8 kernel pointer information leak proof-of-concepts (PoCs) and 24 local privilege escalation exploits. Note that hundreds of issues were identified; this is the subset for which PoCs were automatically generated.
- OpenBSD: The models identified a 23-year-old use-after-free in OpenBSD’s kernel implementation of System V semaphores. OpenAI researchers reproduced the issue and confirmed that it could allow an unprivileged local user to escalate privileges to root.
- FreeBSD: Security researchers at Calif used Codex to find and validate using proof-of-concept exploits for several LPEs in FreeBSD. Across a broader FreeBSD campaign, OpenAI researchers confirmed 34 vulnerabilities and produced 7 local privilege escalation PoCs.
Network:
- dnsmasq: Codex Security independently identified vulnerable patterns corresponding to four of the six dnsmasq CVEs later fixed in
2.92rel2: CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, and CVE-2026-5172. - HTTP/2 Bomb: Calif used Codex to identify “HTTP/2 Bomb,” a denial-of-service technique affecting major HTTP/2 implementations including NGINX, Apache, IIS and Pingora. Calif’s analysis suggested that more than 880,000 Internet-facing websites were running affected server software with HTTP/2 enabled.
Browsers:
- Chrome: OpenAI researchers found and reported five exploitable vulnerabilities in Chrome’s V8 JavaScript engine, including three that were identified and remediated within days of being introduced.
- Safari: In roughly a week of focused WebKit work, over 10 exploitable Safari vulnerabilities were found and reported.
- Firefox: OpenAI Preparedness identified a WebAssembly vulnerability (CVE-2026-8390) with GPT-5.5 during safety evaluations that Mozilla patched two days before Pwn2Own Berlin, prompting five of six registered Firefox entries to withdraw. No Firefox exploit was successfully demonstrated at the competition.
Limitations and Trade-offs
While the early results are impressive, there are important limitations to keep in mind. First, the public details are still limited; many project-specific findings are undergoing coordinated disclosure, and exploit mechanics are being withheld to avoid harm. OpenAI plans to publish deeper technical reports as fixes land and disclosures conclude, sharing individual findings, research methods, validation workflows, and lessons for defenders.
Second, the high volume of false positives from AI models is a real challenge. The program’s success depends on dedicated human reviewers to filter and validate findings before they reach maintainers. Without that step, AI-assisted discovery could overwhelm maintainers further, defeating the purpose.
Third, the program’s scope is currently limited to a set of initial projects, and the long-term sustainability of such collaborations is not yet proven. The reusable infrastructure and workflows are promising, but they require ongoing investment and maintenance.
For product builders and AI tool users, these limitations highlight the need for human oversight and validation in AI-assisted workflows, especially in security-sensitive areas.
Takeaways for Product Builders and AI Tool Users
Patch the Planet offers several practical lessons for teams building products or using AI tools in development:
-
AI is an accelerator, not a replacement. AI can dramatically shorten the time to find and patch vulnerabilities, but human review remains essential. Any team using AI for code analysis or generation should build in validation steps, particularly for security-critical work.
-
Reusable workflows are more valuable than one-off fixes. The fuzzing labs, CVE analysis pipelines, and differential testing systems built by Trail of Bits are assets that can be reused across projects. Investing in tools and processes yields long-term benefits beyond a single patch.
-
Maintainer agency matters. OpenAI emphasizes that maintainers control what patches are deployed and how disclosure is handled. Even when AI automates many steps, final decision-making should remain with humans. This principle applies broadly: AI should augment human judgment, not replace it.
-
Start small and iterate. For teams wanting to adopt similar approaches, begin with a small project, build a fuzzing or vulnerability analysis pipeline, and ensure human review is in place. AI tools can accelerate, but the last mile of security still requires human judgment.
As more fixes land and coordinated disclosures complete, OpenAI plans to publish deeper technical reports on selected findings, the methods used to discover and validate them, and the workflows defenders can adapt. For maintainers interested in joining, applications are open via Trail of Bits.
Open-source software is shared infrastructure. Securing it should be shared work. AI is changing the pace of vulnerability discovery, and the work now is to make sure the benefits reach the maintainers and users who need them most.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.