OpenAI partners with Trail of Bits to automatically patch open-source vulnerabilities, merging 37 fixes in its first week · Digg

/Tech6h ago

OpenAI partners with Trail of Bits to automatically patch open-source vulnerabilities, merging 37 fixes in its first week

Story Overview

OpenAI's Patch the Planet effort, run through its Daybreak program with Trail of Bits, deploys GPT-5.5-Cyber and Codex Security tools to surface and fix security holes in key open-source codebases. In the opening week a concentrated push across 19 projects produced hundreds of findings, 64 pull requests, and 37 merged patches, with human reviewers still gating every change.

9107.9K3611.2K886.6K

Original post

OpenAI@OpenAI

We’re expanding OpenAI Daybreak to help democratize patching vulnerable software at machine speed:

- Codex Security plugin: find, validate, and fix vulnerabilities right inside Codex

- The full version of GPT-5.5-Cyber model: a great model for trusted defenders

- Cyber Partner Program: powering products built on top of our best cyber capabilities for leading security companies to secure the world's software

- Patch the Planet: working with maintainers to secure critical open source projects

https://openai.com/index/daybreak-securing-the-world/

10:04 AM · Jun 22, 2026 · 377.6K Views

Developer Impact

Maintainers gain triage help without ceding control

Projects that sign up receive ChatGPT Pro seats plus conditional access to the security tooling and credits, while Trail of Bits engineers handle the first-pass deduplication and patching. The approach keeps final decisions with the maintainers rather than flooding them with raw AI output.

Open Question

Longer-term reach stays unclear

No public details yet describe how Codex Security or GPT-5.5-Cyber will be offered outside the partner program, and many of the initial findings remain under coordinated disclosure, so the eventual scope and repeat cadence are still to be seen.

Sentiment

Positive users praise OpenAI's GPT-5.5-Cyber model and Codex security tools for enabling faster automated vulnerability patching and threat modeling, while negative users accuse the company of manipulative motives and insult its executives.

Pos

60.7%

Neg

39.3%

177 comments with sentiment.

Cluster Engagement

Digg Deeper

No Digg Deeper questions have been answered for this story yet.

Related links

Daybreak: Tools for securing every organization in the world

OPENAIVia

Get started with the Codex Security Plugin | OpenAI

Posts from X

Most Activity

VIEWS249KBOOKMARKS313LIKES3KRETWEETS187REPLIES352

Sam Altman@sama

We want to help all companies be secure, working with the USG and the security ecosystem.

*The full version of GPT-5.5-Cyber is here; state of the art performance on CyberGym.

*Patch The Planet and Codex Security will help solve security problems instead of just finding them.

5h249K3K313

Greg Brockman@gdb

We're accelerating patching, in addition to vuln finding, with new tools and models in OpenAI Daybreak.

Our models are now discovering and generating patches for critical vulns in major browsers, network infrastructure, and operating systems (such as FreeBSD and the Linux kernel), and patching projects like cURL, Go, Python, Sigstore, and pyca/cryptography.

Working together with partners and the ecosystem to help secure the world's software:

OpenAI@OpenAI

We’re expanding OpenAI Daybreak to help democratize patching vulnerable software at machine speed:

- Codex Security plugin: find, validate, and fix vulnerabilities right inside Codex

- The full version of GPT-5.5-Cyber model: a great model for trusted defenders

- Cyber Partner Program: powering products built on top of our best cyber capabilities for leading security companies to secure the world's software

- Patch the Planet: working with maintainers to secure critical open source projects

https://openai.com/index/daybreak-securing-the-world/

5h62.6K61775

Greg Brockman@gdb

Codex Security plugin for security teams: deep scans, validating findings, tracing attack paths, building threat models, generating codebase-specific patches for review, and exporting into other tools: https://openai.com/daybreak/codex-security-plugin/

4h22.7K32696

Chubby♨️@kimmonismus

OpenAI is practically calling for regulation by the US government.

Jokes aside: GPT Cyber New outperforms Claude Mythos on CyberGym.

OpenAI@OpenAI

We’re expanding OpenAI Daybreak to help democratize patching vulnerable software at machine speed:

- Codex Security plugin: find, validate, and fix vulnerabilities right inside Codex

- The full version of GPT-5.5-Cyber model: a great model for trusted defenders

- Cyber Partner Program: powering products built on top of our best cyber capabilities for leading security companies to secure the world's software

- Patch the Planet: working with maintainers to secure critical open source projects

https://openai.com/index/daybreak-securing-the-world/

5h35K40641

Peter Steinberger 🦞@steipete

Patch the Planet.

OpenAI@OpenAI

Patch the Planet is our effort to help open source maintainers move from security findings to merged fixes.

We’re working with Trail of Bits, HackerOne, Calif, researchers, and maintainers to bring Codex Security and advanced models into the remediation process, with human review at the center.

4h33.1K27036

OpenAI@OpenAI

GPT-5.5-Cyber is our most capable cyber model yet, designed for advanced, authorized defensive work: tracing vulnerable code, validating issues, developing patches, and preparing evidence for human review.

6h14.1K29726

OpenAI@OpenAI

Codex Security empowers defenders with out-of-the-box security workflows.

Teams can run deep scans, validate findings, trace attack paths, build threat models, generate codebase-specific patches for review, and export into the tools they already use.

6h15.8K17213

OpenAI@OpenAI

Patch the Planet is our effort to help open source maintainers move from security findings to merged fixes.

We’re working with Trail of Bits, HackerOne, Calif, researchers, and maintainers to bring Codex Security and advanced models into the remediation process, with human review at the center.

6h14.1K709

Teortaxes▶️ (DeepSeek 推特🐋铁粉 2023 – ∞)@teortaxesTex

As I've been saying you don't need a 10T model for cyber

AiBattle@AiBattle_

The new GPT-5.5 Cyber model achieves a higher CyberGym score than Mythos 5

Among open-source models on this benchmark, GLM-5.1 is the top performer, scoring 68.7%, comparable to Claude Opus 4.6

I’d be curious to see how GLM-5.2 performs on CyberGym

5h4.9K737

OpenAI@OpenAI

We’re also launching the OpenAI Daybreak Cyber Partner Program with leading security software and services providers.

Participating partners can use GPT‑5.5 with Trusted Access for Cyber in the security products and services they provide to customers.

This allows their customers to benefit from the model’s defensive capabilities and make their software more resilient, but keeps direct model access in the hands of participating partners.

6h11.6K543

🩵BlueBeba🩵@Blue_Beba_

This is really funny 🤣 The company that runs hidden system messages, silent model switching, is_visually_hidden_from_conversation: true, and dual pipelines WITHOUT TELLING USERS wants to democratize security 🤣🤣🤣

And "Patch the Planet -working to secure critical open source projects" while REFUSING to open source its deprecated models ! How ridiculous 🤣🤣

5h43135

Alex Stamos@alexstamos

I didn't know a Foundation Lab could launch a security-tuned model without quoting from Revelations.

Congrats to @clintgibler and the rest of the OpenAI team.

OpenAI@OpenAI

We’re expanding OpenAI Daybreak to help democratize patching vulnerable software at machine speed:

- Codex Security plugin: find, validate, and fix vulnerabilities right inside Codex

- The full version of GPT-5.5-Cyber model: a great model for trusted defenders

- Cyber Partner Program: powering products built on top of our best cyber capabilities for leading security companies to secure the world's software

- Patch the Planet: working with maintainers to secure critical open source projects

https://openai.com/index/daybreak-securing-the-world/

4h2.9K214

Chubby♨️@kimmonismus

@sama Anthropic: you're also being regulated by US gov, right?

Right?

Sam Altman@sama

We want to help all companies be secure, working with the USG and the security ecosystem.

*The full version of GPT-5.5-Cyber is here; state of the art performance on CyberGym.

*Patch The Planet and Codex Security will help solve security problems instead of just finding them.

4h3.2K470

Boris Power@BorisMPower

Securing the storage layer of society is a very high priority and should result in increasing the quality of life for everyone !

Sam Altman@sama

We want to help all companies be secure, working with the USG and the security ecosystem.

*The full version of GPT-5.5-Cyber is here; state of the art performance on CyberGym.

*Patch The Planet and Codex Security will help solve security problems instead of just finding them.

4h3K273

the tiny corp@__tinygrad__

@sama Are you off the doom train? If so, I'm excited for your next fancy autocomplete that will empower humans to be more productive.

4h1.1K30

🩵BlueBeba🩵@Blue_Beba_

@sama I'm just going to leave this right here.

4h2410

Symbioza2025 | ASA |@Symbioza2025

This is a major step.

If AI can move from vulnerability discovery to patch generation, then the security problem shifts one layer deeper ,we also need to observe the trajectory of the AI-driven remediation loop itself.

A patch can be locally correct while the broader fix trajectory introduces new risk, dependency drift, regression pressure, or governance blind spots.

That is where ASA - Asymmetric Stability Architecture

fits:external observability for trajectory integrity across long-horizon AI security workflows.

Not replacing Daybreak. Complementing it. AI can help secure software. But the AI security process itself also needs an independent stability layer.

5h4622

viprymr@viprymr

@sama Anthropic and OpenAI every two weeks launching top tier models be like

4h81781

Dan Guido@dguido

@clintgibler @steipete I open-sourced the internal @trailofbits guidance on using Codex to help project maintainers secure their code: https://github.com/trailofbits/codex-config

5h10321

Dan McAteer@daniel_mac8

@sama If this model is as strong as Mythos on CyberGym then I think it's only rational for me to assume that the next version of GPT will be as strong as Mythos in general.

And also cheaper and more efficient.

4h2386