OpenAI launches Patch the Planet to fix open-source bugs

Patch the Planet is the latest initiative under OpenAI's Daybreak umbrella, building on prior work that shows frontier models can help defenders find vulnerabilities in widely used software. The program's design reflects a key reality: while AI accelerates discovery, maintainers are already overwhelmed by reports, so the bottleneck has shifted to validation and patching. By inserting human security engineers between AI findings and maintainers, the initiative tries to deliver high-signal results without adding to the noise.

The early results span operating systems, network software, and browsers, showing the approach works across different layers of the stack. Findings include eight kernel pointer information leak PoCs and 24 local privilege escalation exploits in the Linux kernel, a 23-year-old use-after-free in OpenBSD, and multiple exploitable vulnerabilities in Chrome and Safari. These wins came from combining models like GPT-5.5-Cyber with human expertise, as well as from reusable infrastructure like fuzzing harnesses and CVE-variant analysis pipelines that can be applied across future projects.

The longer-term stake is whether this model of AI-plus-human collaboration can scale beyond the initial 19 projects. The program intends to expand with additional projects in future rounds, and OpenAI plans to publish deeper technical reports as coordinated disclosures conclude. Success hinges on whether the reusable workflows and infrastructure Trail of Bits built genuinely reduce the ongoing security burden for maintainers, and whether other defenders can adapt these methods to protect the open-source software the world depends on.