Open-source software powers much of the internet, from operating systems and web servers to encryption libraries and programming languages.
However, it also faces a growing security challenge, as artificial intelligence (AI) is making it much faster to find software vulnerabilities. And fixing these flaws before attackers exploit them remains a difficult task.
OpenAI believes it can help close that gap. The company has introduced Patch the Planet, a new initiative under its Daybreak cybersecurity program that aims to help open-source maintainers identify, validate, and fix vulnerabilities before they become security incidents.
A Project Built Around Fixing, Not Just Finding
Patch the Planet combines OpenAI’s cybersecurity focused AI models with human security experts from Trail of Bits. The goal is not simply to generate vulnerability reports but to help maintainers move all the way from discovery to tested patches and responsible disclosure.
According to OpenAI, every finding is reviewed by security engineers before it reaches project maintainers. This review process is designed to remove false positives, confirm the severity of issues, develop patches, and coordinate disclosure through each project’s existing security process.
Trail of Bits has committed its entire security research organization to the project’s initial phase. And OpenAI is also working with HackerOne and Calif to support vulnerability triage, coordinated disclosure, and additional security research.
The First Projects are Already Underway
Several widely used open-source projects are participating in the first round. These include cURL, Python, Go, Sigstore, aiohttp, pyca/cryptography, NATS Server, freenginx, and python.org.
Beyond security reviews, participating projects receive access to ChatGPT Pro, conditional access to Codex Security, and API credits that can support development workflows and maintainer automation.
OpenAI noted that these resources are intended to help maintainers continue improving security even after the first vulnerabilities are resolved.
Early Results Point to Large Scale Security Work
OpenAI says Trail of Bits engineers have already worked across 19 open-source projects using GPT-5.5-Cyber and Codex. During those engagements, researchers identified hundreds of security issues and merged dozens of patches, while many additional findings remain under coordinated disclosure.
The company also said AI-assisted workflows helped researchers build fuzz testing systems, analyze historical vulnerabilities, generate threat models, expand test coverage, and automate parts of patch development that would normally require weeks of engineering work. However, human researchers still reviewed every confirmed vulnerability before notifying maintainers.
OpenAI shared examples from its broader Daybreak research showing that its models have helped identify vulnerabilities across Linux, OpenBSD, FreeBSD, Chrome, Safari, Firefox, and widely used networking software. In many cases, technical details remain undisclosed until vendors complete the patching process.
Why This Matters
Open-source software sits underneath countless commercial products, cloud services, and critical infrastructure. A vulnerability in one widely used project can affect thousands of downstream applications.
OpenAI argues that vulnerability discovery is no longer the biggest challenge. The harder problem is helping maintainers verify reports, write reliable fixes, test those fixes, and release them safely. Patch the Planet is designed to support that entire process while leaving maintainers in control of what gets deployed and when.
If the initiative succeeds at scale, it could help shorten the time between discovering a software flaw and delivering a working fix. In an era where AI is accelerating both cyber defense and cyber offense, reducing that time may become one of the most important ways to protect the software the internet depends on.
