OpenAI launches Patch the Planet to fix open-source security vulnerabilities at scale

OpenAI has unveiled a new initiative called Patch the Planet, designed to address a persistent and often overlooked issue: the chronic underfunding of open-source security. This effort aims to reduce the burden on volunteer maintainers who struggle to keep up with a rising tide of security flaws.

By combining OpenAI’s most advanced security-focused AI models with the expertise of security firm Trail of Bits, the project seeks to turn the tide on vulnerability management. Support also comes from bug bounty platform HackerOne and other partners.

How Patch the Planet works to improve open-source security

The core problem is straightforward: AI tools can now generate vast numbers of potential vulnerabilities, but sorting real threats from false alarms remains a manual, time-consuming task. Overworked maintainers, many working for free, are drowning in low-quality, AI-generated bug reports.

OpenAI’s cyber tech lead Fouad Matin noted that maintainers do this work out of love for open source, yet now find themselves overwhelmed. Trail of Bits CEO Dan Guido called the project a massive effort to help open-source software get ahead of AI bug hunting tools, while also demonstrating the positive side of AI coding tools.

Researchers use OpenAI’s Codex Security and GPT-5.5-Cyber models to investigate and validate issues. Every finding is personally reviewed before it reaches a maintainer. Additionally, OpenAI is subsidizing roughly 20 trillion tokens of Codex Security usage for both open-source and private code.

Why this matters beyond bug fixes

More than 30 projects are already participating, including cURL, Python, and the Go project. Trail of Bits is running an opening sprint with a fifth of its entire workforce. In its first week alone, the effort has surfaced hundreds of bugs and dozens of patches.

This announcement comes as rival Anthropic was forced to pull its Mythos 5 and Fable 5 models from the market over White House concerns about AI cybersecurity capabilities. OpenAI’s updated GPT-5.5-Cyber reportedly outscores Mythos 5 on the CyberGym benchmark, 85.6% to 83.8%.

That benchmark gap may seem small, but it signals that the real race between AI labs could shape internet security far more than any single product launch. For maintainers, the hope is that AI can become a tool for open-source security rather than another source of noise.

What this means for the future of open-source security

Building on this, Patch the Planet could set a new standard for how AI is used in vulnerability management. Instead of flooding maintainers with alerts, the initiative filters and validates issues before they ever become a problem. This approach could reduce burnout and help projects stay secure.

Furthermore, the partnership with Trail of Bits ensures that human expertise remains central. AI handles the initial analysis, but experts verify every finding. This hybrid model may become a blueprint for other cybersecurity efforts.

On the other hand, critics might question whether such initiatives can scale beyond flagship projects. Smaller open-source tools often lack visibility and resources. However, OpenAI’s substantial token subsidy and the involvement of HackerOne suggest a commitment to broad impact.

Therefore, Patch the Planet represents more than a bug-fixing drive. It is an attempt to rebalance the relationship between AI and open-source security, turning AI from a threat into an ally. For maintainers, that shift cannot come soon enough.

For more insights, read about how AI changes cybersecurity or explore open-source tools for developers.

Meta has quietly hit the brakes on a controversial employee monitoring tool after an internal leak exposed sensitive worker data across the entire company. The incident, first reported by Wired, has sparked outrage among staff and raised fresh questions about privacy in the workplace.

The tool, known as the Model Capability Initiative (MCI), was designed to collect keystrokes, mouse movements, and screen content from employee laptops in the United States. It had been running since April without widespread awareness, according to internal documents.

What Was the Meta Employee Surveillance Tool Doing?

Meta launched MCI with the stated goal of training artificial intelligence systems to mimic human computer interactions. Executives argued that employees were the ideal source for this training data, as their workflows represented complex, real-world tasks. However, the program quickly drew criticism.

More than 1,600 employees signed an internal petition opposing the Meta employee surveillance initiative. They warned that it posed serious security and regulatory risks. One engineer described having their screen scraped without consent as a clear invasion of privacy.

CEO Mark Zuckerberg reportedly defended the effort in a leaked audio recording. He claimed that AI models learn best by observing skilled workers, and that Meta’s own staff outperformed average contractors for this purpose.

How a Data Leak Forced Meta’s Hand

The turning point came when an internal security notice revealed that data across 45,000 database tables had been exposed company-wide. This included private conversations, full prompts, transcriptions, and performance data. The leak effectively confirmed the worst fears of critics.

Meta spokesperson Tracy Clayton stated that the company has no evidence that anyone improperly accessed the data. Nevertheless, Meta has paused the Meta employee surveillance program while it investigates. Employees flooded internal forums with criticism, with one former staffer calling the lapse a mess that workers had already predicted.

Meta’s CTO Andrew Bosworth acknowledged internally that the program fell short of the company’s own privacy review standards. This is not Meta’s first AI-related security stumble. In March, an AI agent acted without permission, and a chatbot exploit allowed hackers to hijack Instagram accounts.

Broader Implications for Worker Privacy

This incident highlights a growing tension between corporate AI ambitions and employee privacy rights. Many companies are exploring similar monitoring tools, but few have faced such public backlash. The Meta employee surveillance case could set a precedent for how tech giants handle internal data collection.

For workers, the key concern is consent. Monitoring keystrokes, mouse movements, and screen content goes far beyond typical productivity tracking. It captures intimate details of how individuals work, including personal communications and creative processes.

Regulators may also take note. The exposure of 45,000 database tables raises questions about compliance with data protection laws like GDPR and CCPA. Meta could face fines if investigators find that the program violated employee privacy rights.

What Comes Next for Meta?

The pause may calm tensions for now, but trust has been damaged. Morale at Meta was already strained by layoffs and reorganization. This incident adds another layer of uncertainty.

Meta must now decide whether to revive MCI with stronger safeguards or abandon it entirely. The company faces pressure to rebuild trust with its workforce. Meanwhile, the tech industry watches closely: if a giant like Meta stumbles on employee surveillance, others may think twice.

For more on workplace AI ethics, see our guide on employee monitoring best practices. Also check out AI privacy concerns in the workplace.

In the end, the Meta employee surveillance saga serves as a cautionary tale. Innovation and privacy can coexist, but only if companies prioritize transparency and consent from the start.

Windows 11 Gets Copilot Again — This Time Through Office Updates, Unless You’re in Europe

Just two months after making Copilot removable from Windows 11, Microsoft is quietly reinstalling it. The tech giant has shifted tactics, using the Office suite’s update mechanism instead of the Microsoft Store. This new Copilot Windows 11 installation method is harder to block, but it does not affect all users — particularly those in Europe.

How Microsoft Is Reinstalling Copilot on Windows 11

Instead of relying on the Microsoft Store’s auto-install feature — which administrators and users could disable — Microsoft is now bundling Copilot with updates for commercial Microsoft 365 desktop apps. The rollout runs from mid-June to mid-July, giving it roughly a 30-day window to land on enterprise machines.

This means that if your organization uses Microsoft 365 Business accounts, Copilot may appear without warning. The only way to prevent it is for an administrator to disable Copilot in the Admin Center before the update hits.

Why Europe Is Exempt From the Copilot Installation

Users in the European Union are currently spared from this forced installation. The exemption likely stems from competition law, which has previously kept Microsoft from aggressively bundling products in European markets. This is not the first time the region has received special treatment — similar legal scrutiny has shaped Microsoft’s rollout strategies for years.

It is worth noting that the change does not affect regular Windows 11 Home users either. Only commercial Microsoft 365 accounts are targeted, meaning the majority of consumers remain untouched.

The Admin Settings Are Deliberately Scattered

For organizations that want to block Copilot, the process is intentionally cumbersome. Settings to disable the AI assistant are spread across the Admin Center and individual app configurations for Word, Excel, PowerPoint, Outlook, and Teams. Microsoft calls this approach a way to “simplify” access, but critics see it as friction designed to discourage removal.

Building on this, a previously leaked internal document revealed that Microsoft’s goal with its AI products is not just adoption but to create dependency. The force-install method and the deliberate difficulty around removing Copilot align with that broader strategy.

What This Means for Enterprise IT Administrators

If you manage a fleet of Windows 11 machines running Microsoft 365, you need to act before mid-July. Log into the Admin Center and navigate to the Copilot settings. From there, disable the assistant across all apps. This is the only reliable way to stop the update from adding Copilot to your users’ systems.

However, even after disabling it, some users may still see the Copilot icon. In that case, you can remove it manually via Group Policy or registry edits. For more details, check our guide on how to remove Copilot from Windows 11.

The Bigger Picture: Microsoft’s AI Dependency Strategy

This move is part of a larger push to integrate Microsoft Copilot deeply into the Windows ecosystem. The company is betting big on AI, and it wants users to rely on its tools rather than third-party alternatives. By making Copilot harder to remove, Microsoft ensures that even reluctant users are exposed to its AI features.

For those in Europe, the exemption may be temporary. Competition laws could change, or Microsoft might find another workaround. In the meantime, IT administrators outside the EU should prepare for the forced installation and take steps to block it before the June-July window closes.

As always, staying informed about Windows 11 updates is key to maintaining control over your organization’s devices. The Copilot saga is far from over.