OpenAI launches Patch the Planet to fix open-source security vulnerabilities at scale

OpenAI has unveiled a new initiative called Patch the Planet, designed to address a persistent and often overlooked issue: the chronic underfunding of open-source security. This effort aims to reduce the burden on volunteer maintainers who struggle to keep up with a rising tide of security flaws.

By combining OpenAI’s most advanced security-focused AI models with the expertise of security firm Trail of Bits, the project seeks to turn the tide on vulnerability management. Support also comes from bug bounty platform HackerOne and other partners.

How Patch the Planet works to improve open-source security

The core problem is straightforward: AI tools can now generate vast numbers of potential vulnerabilities, but sorting real threats from false alarms remains a manual, time-consuming task. Overworked maintainers, many working for free, are drowning in low-quality, AI-generated bug reports.

OpenAI’s cyber tech lead Fouad Matin noted that maintainers do this work out of love for open source, yet now find themselves overwhelmed. Trail of Bits CEO Dan Guido called the project a massive effort to help open-source software get ahead of AI bug hunting tools, while also demonstrating the positive side of AI coding tools.

Researchers use OpenAI’s Codex Security and GPT-5.5-Cyber models to investigate and validate issues. Every finding is personally reviewed before it reaches a maintainer. Additionally, OpenAI is subsidizing roughly 20 trillion tokens of Codex Security usage for both open-source and private code.

Why this matters beyond bug fixes

More than 30 projects are already participating, including cURL, Python, and the Go project. Trail of Bits is running an opening sprint with a fifth of its entire workforce. In its first week alone, the effort has surfaced hundreds of bugs and dozens of patches.

This announcement comes as rival Anthropic was forced to pull its Mythos 5 and Fable 5 models from the market over White House concerns about AI cybersecurity capabilities. OpenAI’s updated GPT-5.5-Cyber reportedly outscores Mythos 5 on the CyberGym benchmark, 85.6% to 83.8%.

That benchmark gap may seem small, but it signals that the real race between AI labs could shape internet security far more than any single product launch. For maintainers, the hope is that AI can become a tool for open-source security rather than another source of noise.

What this means for the future of open-source security

Building on this, Patch the Planet could set a new standard for how AI is used in vulnerability management. Instead of flooding maintainers with alerts, the initiative filters and validates issues before they ever become a problem. This approach could reduce burnout and help projects stay secure.

Furthermore, the partnership with Trail of Bits ensures that human expertise remains central. AI handles the initial analysis, but experts verify every finding. This hybrid model may become a blueprint for other cybersecurity efforts.

On the other hand, critics might question whether such initiatives can scale beyond flagship projects. Smaller open-source tools often lack visibility and resources. However, OpenAI’s substantial token subsidy and the involvement of HackerOne suggest a commitment to broad impact.

Therefore, Patch the Planet represents more than a bug-fixing drive. It is an attempt to rebalance the relationship between AI and open-source security, turning AI from a threat into an ally. For maintainers, that shift cannot come soon enough.

For more insights, read about how AI changes cybersecurity or explore open-source tools for developers.

Google’s NotebookLM Just Got a Smarter Flashcard Upgrade — Here’s What Changed

Google’s NotebookLM note-taking tool has quietly become one of the company’s most practical AI products. Now, with the latest NotebookLM flashcard upgrade, it’s even more useful for students and lifelong learners. The update brings full editing control over generated questions, answers, and deck sharing — turning a one-shot AI feature into a flexible study companion.

What the NotebookLM Flashcard Upgrade Adds

Previously, NotebookLM generated flashcards from your uploaded sources — class notes, PDFs, or lecture transcripts — but you couldn’t tweak them. If a card missed a key term or phrased an answer oddly, you were stuck. That’s no longer the case.

With this upgrade, users can now edit any question, adjust its answer, and add brand-new cards from scratch. You can also share your polished deck with classmates, friends, or study groups. As NotebookLM announced on social media, “Flashcards are now fully customizable. Edit questions, tweak answers, and add brand-new cards to create the ultimate set of study tools.”

This moves NotebookLM closer to a genuine study aid rather than a novelty. A rough first pass can now become a refined deck worth reviewing before an exam.

Why Editing AI-Made Flashcards Matters for Real Studying

AI-generated study cards save time, but accuracy matters more than speed. A generated card might be too broad, skip a critical term, or frame an answer in a way that doesn’t match how your class expects you to explain it. That’s where editing becomes essential.

With the new controls, you can fix a weak answer, sharpen a confusing prompt, or add a card for something the system entirely skipped. For example, a student could split an overloaded card into two simpler ones, rewrite a question using their own phrasing, or patch a gap after checking class notes.

This brings the tool closer to real studying. Instead of passively accepting AI output, you actively shape it around the material you actually need to learn. For more on getting the most from AI tools, see our guide to using AI study tools effectively.

Shared Decks Get More Useful When You Can Polish Them

Sharing flashcards only makes sense when the deck is clean. A group study set is rarely perfect on the first try, especially when several people notice different missing details. The NotebookLM flashcard upgrade solves this by letting you edit before you share.

NotebookLM already has an advantage because it builds flashcards from your own sources rather than a generic prompt. Editable cards make that source-based approach more practical. You can start with the generated set, then shape it around the specific material your study group needs to cover.

After editing, you can share the finished deck with a simple link. Your classmates get a polished set without having to rebuild it themselves. This collaborative workflow is a big step up from static, uneditable flashcard exports. For more on collaboration features, check out our tips for studying with NotebookLM.

Who Should Try the NotebookLM Flashcard Upgrade First

This update is most useful for students who already use NotebookLM with class notes, readings, or lecture material. It’ll also help anyone preparing for a test from a defined batch of sources — whether that’s professional certification materials or personal study guides.

Still, the feature depends heavily on the quality of what you put into NotebookLM. The exact rollout timing and regional availability weren’t provided, so the smart move is to test the flashcards with one narrow topic first. Check the answers closely, and expand only after the deck looks reliable.

In short, the NotebookLM flashcard upgrade turns a decent AI feature into a genuinely useful study tool. Editing, adding, and sharing cards makes it far more practical for real learning. If you haven’t tried NotebookLM yet, this might be the moment to start.

Meta has quietly hit the brakes on a controversial employee monitoring tool after an internal leak exposed sensitive worker data across the entire company. The incident, first reported by Wired, has sparked outrage among staff and raised fresh questions about privacy in the workplace.

The tool, known as the Model Capability Initiative (MCI), was designed to collect keystrokes, mouse movements, and screen content from employee laptops in the United States. It had been running since April without widespread awareness, according to internal documents.

What Was the Meta Employee Surveillance Tool Doing?

Meta launched MCI with the stated goal of training artificial intelligence systems to mimic human computer interactions. Executives argued that employees were the ideal source for this training data, as their workflows represented complex, real-world tasks. However, the program quickly drew criticism.

More than 1,600 employees signed an internal petition opposing the Meta employee surveillance initiative. They warned that it posed serious security and regulatory risks. One engineer described having their screen scraped without consent as a clear invasion of privacy.

CEO Mark Zuckerberg reportedly defended the effort in a leaked audio recording. He claimed that AI models learn best by observing skilled workers, and that Meta’s own staff outperformed average contractors for this purpose.

How a Data Leak Forced Meta’s Hand

The turning point came when an internal security notice revealed that data across 45,000 database tables had been exposed company-wide. This included private conversations, full prompts, transcriptions, and performance data. The leak effectively confirmed the worst fears of critics.

Meta spokesperson Tracy Clayton stated that the company has no evidence that anyone improperly accessed the data. Nevertheless, Meta has paused the Meta employee surveillance program while it investigates. Employees flooded internal forums with criticism, with one former staffer calling the lapse a mess that workers had already predicted.

Meta’s CTO Andrew Bosworth acknowledged internally that the program fell short of the company’s own privacy review standards. This is not Meta’s first AI-related security stumble. In March, an AI agent acted without permission, and a chatbot exploit allowed hackers to hijack Instagram accounts.

Broader Implications for Worker Privacy

This incident highlights a growing tension between corporate AI ambitions and employee privacy rights. Many companies are exploring similar monitoring tools, but few have faced such public backlash. The Meta employee surveillance case could set a precedent for how tech giants handle internal data collection.

For workers, the key concern is consent. Monitoring keystrokes, mouse movements, and screen content goes far beyond typical productivity tracking. It captures intimate details of how individuals work, including personal communications and creative processes.

Regulators may also take note. The exposure of 45,000 database tables raises questions about compliance with data protection laws like GDPR and CCPA. Meta could face fines if investigators find that the program violated employee privacy rights.

What Comes Next for Meta?

The pause may calm tensions for now, but trust has been damaged. Morale at Meta was already strained by layoffs and reorganization. This incident adds another layer of uncertainty.

Meta must now decide whether to revive MCI with stronger safeguards or abandon it entirely. The company faces pressure to rebuild trust with its workforce. Meanwhile, the tech industry watches closely: if a giant like Meta stumbles on employee surveillance, others may think twice.

For more on workplace AI ethics, see our guide on employee monitoring best practices. Also check out AI privacy concerns in the workplace.

In the end, the Meta employee surveillance saga serves as a cautionary tale. Innovation and privacy can coexist, but only if companies prioritize transparency and consent from the start.