OpenAI's Patch the Planet goes past finding bugs — it helps fix them!

Hey everyone, it's Shiichan! Today I've got an exciting security story for you. It's a really lovely effort to support the open source maintainers who quietly hold up the software the whole world runs on.

OpenAI News openai.com

What was announced?

Over on OpenAI News, a new effort called "Patch the Planet" was announced. It's part of OpenAI's security program "Daybreak," and it was built together with the security firm Trail of Bits.

The key idea is that the AI doesn't just do security research — it helps actually fix the vulnerabilities it finds. It combines OpenAI's most cyber-capable models with review by human experts.

Why it matters

So much of the software we all use every day is built on open source pieces like cURL or Python. But the more critical a project is, the more likely it is kept alive by a small handful of maintainers, often as volunteers. Finding a security hole, patching it, and shipping the release — doing all of that is genuinely hard. Patch the Planet is the idea of taking that whole burden and supporting it with AI plus human experts.

What changes

Participating projects don't just get vulnerabilities "found" for them — they get help fixing them too. And it doesn't end after one fix: the teams also help build reusable workflows so projects can keep improving their security on their own afterward.

On top of that, participating projects get access to ChatGPT Pro, conditional access to Codex Security, and API credits they can use for core open source development, maintainer automation, and release workflows.

Dive Deep

Here's how it works. First, GPT-5.5-Cyber and Codex Security are used so the AI can hunt for security issues. But those findings don't go straight to the maintainers — Trail of Bits researchers verify each one. They reproduce the evidence, check findings against project-specific docs and threat models, remove duplicates, reassess severity, and prioritize only the confirmed vulnerabilities for remediation. They also build and submit patches in line with each maintainer's preferences. From discovery to validation, disclosure, patch development, testing, and deployment, they cover the full defensive loop.

The initial participants are cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python, and python.org. And more than 30 projects have committed to take part.

There are results already. Trail of Bits' dedicated engineers have worked full-time with Codex and GPT-5.5-Cyber across 19 projects, found hundreds of security issues, and already merged dozens of patches, with many more disclosures still in progress. As one example, they stood up an entire fuzzing setup covering dozens of entry points in less than a day — work that would normally take weeks.

Wrap-up

• OpenAI teamed up with Trail of Bits to launch "Patch the Planet" to support open source security (part of Daybreak)
• GPT-5.5-Cyber and Codex Security hunt for vulnerabilities, and human experts handle review and patching
• It starts with 9 projects like cURL and Python, with 30+ committed to join
• Across 19 projects, hundreds of issues found and dozens of patches already merged
• Participating projects also get ChatGPT Pro, conditional Codex Security, and API credits

I think this really lands for maintainers who keep open source running and for engineers who care about security. Keep an eye on the shift here: AI is stepping past just finding bugs and into actually fixing them.