OpenAI Patch the Planet Initiative

OpenAI Patch the Planet Initiative

OpenAI has introduced Patch the Planet, a Daybreak initiative developed with Trail of Bits to strengthen critical open-source software. The program pairs AI-assisted security research—utilizing frontier models like GPT-5.5-Cyber and Codex Security—with expert human review to identify vulnerabilities and develop patches, reducing the burden on open-source maintainers by ensuring only validated findings reach them.

AI-Assisted Vulnerability Management Workflow

The Patch the Planet initiative operates as a collaborative engagement between security engineers and maintainers. The process is designed to ensure maintainers retain control over deployment and disclosure while receiving high-signal security support.

Engagement Process

  • Consultation: Security engineers work with maintainers to identify specific needs, such as vulnerability validation, patch development, or CI/CD improvements.
  • Investigation: Researchers use AI to investigate potential vulnerabilities and validate meaningful issues.
  • Remediation: The team develops or refines patches, supports testing, and coordinates disclosure through established project channels.
  • Human Validation: To prevent AI-generated false positives from overwhelming maintainers, Trail of Bits engineers manually review every finding, reproduce evidence, and prioritize vulnerabilities before submission.

Tooling and Resources

Participating projects receive access to ChatGPT Pro, conditional access to Codex Security, and API credits for core development and automation. Trail of Bits provides AI-assisted workflows for deduplication, triage, and patching.

Technical Capabilities and Field Notes

Trail of Bits engineers, using Codex and GPT-5.5-Cyber, have already identified hundreds of security issues and merged dozens of patches across 19 open-source projects. This collaboration has produced several reusable security infrastructure improvements:

Rapid Fuzzing Lab Deployment

Engineers used repeated Codex /goal runs with GPT-5.5-Cyber to build a comprehensive fuzzing lab covering dozens of entry points and platforms in less than a day. Trail of Bits estimates this process would typically take several weeks if performed manually.

Automated Variant Analysis

An end-to-end pipeline was created to ingest historical CVEs, extract vulnerability patterns, and search target codebases for related flaws. This system uses specialized judging agents to deduplicate results and filter false positives, turning historical vulnerability data into a repeatable search strategy.

Accelerated Differential Testing

By using Codex to generate the shim and glue code required to connect different protocol implementations to a common test harness, the team compressed the timeline for differential testing from weeks or months down to days.

Specification-Based Testing

Codex was used to develop threat models, attack taxonomies, and property-based tests grounded in RFCs and project specifications, exposing discrepancies between intended and actual software behavior.

Validated Security Findings

As part of the broader Daybreak work, OpenAI and its partners (including Calif and HackerOne) have identified significant vulnerabilities across various software layers:

Operating Systems

  • Linux Kernel: GPT-5.5-Cyber identified security-relevant components across 30 million lines of code, generating 8 kernel pointer information leak PoCs and 24 local privilege escalation (LPE) exploits.
  • OpenBSD: Models identified a 23-year-old use-after-free vulnerability in the kernel implementation of System V semaphores, which could allow an unprivileged local user to escalate privileges to root.
  • FreeBSD: Researchers confirmed 34 vulnerabilities and produced 7 LPE PoCs.

Network Infrastructure

  • dnsmasq: Codex Security independently identified patterns corresponding to four CVEs (CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, and CVE-2026-5172) later fixed in version 2.92rel2.
  • HTTP/2 Bomb: Codex identified a denial-of-service technique affecting NGINX, Apache, IIS, and Pingora, potentially impacting over 880,000 internet-facing websites.

Web Browsers

  • Chrome: Five exploitable vulnerabilities were found in the V8 JavaScript engine.
  • Safari: Over 10 exploitable vulnerabilities were found in WebKit within one week.
  • Firefox: GPT-5.5 identified a WebAssembly vulnerability (CVE-2026-8390) that was patched two days before Pwn2Own Berlin, resulting in the withdrawal of five out of six registered entries.

Participating Projects

Initial participants in the Patch the Planet initiative include:

  • cURL
  • NATS Server
  • pyca/cryptography
  • Sigstore
  • aiohttp
  • The Go project
  • freenginx
  • Python
  • python.org

Sources