OpenAI's Patch the Planet helps maintainers secure open-source software

On 22 June 2026, OpenAI announced Patch the Planet, a Daybreak initiative built with Trail of Bits to help maintainers of widely used open-source software. The programme pairs AI-assisted security research with expert human review, with the aim of finding vulnerabilities and helping to patch them, rather than sending raw findings to already stretched project teams.

How it works

OpenAI says each engagement starts in consultation with the maintainer. Security engineers agree with the project where help would be most useful, which may include validating vulnerabilities, developing patches, improving CI/CD, or longer-term security engineering. Researchers then investigate, validate meaningful issues, help develop or refine patches, support testing, and coordinate disclosure through the project's established channels. Security engineers review findings before they reach maintainers, including reproducing evidence, removing duplicates, and reassessing severity. Maintainers remain in control of what patches are deployed and how disclosure is handled.

Trail of Bits committed its entire security research organisation to the initial surge. OpenAI is also partnering with HackerOne and Calif on vulnerability triage, coordinated disclosure, and further discovery work.

Initial participants include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python, and python.org. OpenAI says further projects will join in later rounds.

Security researchers on the programme use OpenAI's frontier models and Codex Security. Participating projects receive access to ChatGPT Pro, conditional access to Codex Security, and API credits for core open-source development, maintainer automation, and release workflows. Trail of Bits has also developed AI-assisted workflows for deduplication, triage, and patching that projects can run with that support.

Early results

According to OpenAI's announcement, Trail of Bits assigned security engineers to work full-time with Codex and GPT-5.5-Cyber across 19 open-source projects. The company says the team had already identified hundreds of security issues and merged dozens of patches, with more still going through coordinated disclosure. The first sprint also produced reusable security infrastructure, including fuzzing harnesses, pipelines that look for variants of known vulnerabilities, differential-testing systems, threat models, expanded test suites, and workflows for triage and patch generation. OpenAI says some project-specific details will be shared later as testing, remediation, and coordinated disclosure progress.

The same announcement describes a broader body of Daybreak work on widely used software, including operating systems, network services, and browsers, and says OpenAI is withholding exploit mechanics and project-specific details where disclosure is still under way. As fixes land, OpenAI says it plans to publish deeper technical reports.

Later coordination on PHP

On 21 October 2026, OpenAI published a follow-up on Patch the Planet describing a coalition of maintainers, researchers, and security providers that addressed critical vulnerabilities in PHP. OpenAI says Calif identified a critical flaw using GPT-5.6 Sol as part of the initiative, and that Wiz independently discovered and reported both vulnerabilities. PHP's maintainers led the fixes and release, with partners including Wiz and Cloudflare contributing research, technical support, and coordination.

For organisations using PHP, OpenAI says the priority is applying the official fixes. We covered those flaws in an earlier HackTrack briefing. Public guidance and disclosures are collected on the Patch the Planet website. OpenAI also shared a PHP version checker as a Codex skill to help operators identify potentially vulnerable versions.

In the same post, OpenAI proposed a five-stage approach to coordinating responses to critical flaws in widely used software, covering validation and upstream fixes, giving affected organisations time to prepare protections, working with government partners, preparing updates across products, and publishing guidance once a patch is available. It also said it had committed $1 billion in subsidised Daybreak access through Daybreak for Frontline Defenders, aimed at organisations with limited security resources that protect essential services.

The remedy

This is not a single product vulnerability, and there is no one patch that applies to every reader. Open-source maintainers who want hands-on support can apply to join Patch the Planet. Operators should follow the official guidance for any project they run; if you use PHP, apply the maintainers' official updates as described in our earlier briefing. OpenAI's original announcement is Patch the Planet: a Daybreak initiative to support open source maintainers, and the October follow-up is Patch the Planet: global response coordination as agents uncover critical vulnerabilities.