OpenAI launches Patch the Planet to fix open-source security vulnerabilities at scale
OpenAI has unveiled a new initiative called Patch the Planet, designed to address a persistent and often overlooked issue: the chronic underfunding of open-source security. This effort aims to reduce the burden on volunteer maintainers who struggle to keep up with a rising tide of security flaws.
By combining OpenAI’s most advanced security-focused AI models with the expertise of security firm Trail of Bits, the project seeks to turn the tide on vulnerability management. Support also comes from bug bounty platform HackerOne and other partners.
How Patch the Planet works to improve open-source security
The core problem is straightforward: AI tools can now generate vast numbers of potential vulnerabilities, but sorting real threats from false alarms remains a manual, time-consuming task. Overworked maintainers, many working for free, are drowning in low-quality, AI-generated bug reports.
OpenAI’s cyber tech lead Fouad Matin noted that maintainers do this work out of love for open source, yet now find themselves overwhelmed. Trail of Bits CEO Dan Guido called the project a massive effort to help open-source software get ahead of AI bug hunting tools, while also demonstrating the positive side of AI coding tools.
Researchers use OpenAI’s Codex Security and GPT-5.5-Cyber models to investigate and validate issues. Every finding is personally reviewed before it reaches a maintainer. Additionally, OpenAI is subsidizing roughly 20 trillion tokens of Codex Security usage for both open-source and private code.
Why this matters beyond bug fixes
More than 30 projects are already participating, including cURL, Python, and the Go project. Trail of Bits is running an opening sprint with a fifth of its entire workforce. In its first week alone, the effort has surfaced hundreds of bugs and dozens of patches.
This announcement comes as rival Anthropic was forced to pull its Mythos 5 and Fable 5 models from the market over White House concerns about AI cybersecurity capabilities. OpenAI’s updated GPT-5.5-Cyber reportedly outscores Mythos 5 on the CyberGym benchmark, 85.6% to 83.8%.
That benchmark gap may seem small, but it signals that the real race between AI labs could shape internet security far more than any single product launch. For maintainers, the hope is that AI can become a tool for open-source security rather than another source of noise.
What this means for the future of open-source security
Building on this, Patch the Planet could set a new standard for how AI is used in vulnerability management. Instead of flooding maintainers with alerts, the initiative filters and validates issues before they ever become a problem. This approach could reduce burnout and help projects stay secure.
Furthermore, the partnership with Trail of Bits ensures that human expertise remains central. AI handles the initial analysis, but experts verify every finding. This hybrid model may become a blueprint for other cybersecurity efforts.
On the other hand, critics might question whether such initiatives can scale beyond flagship projects. Smaller open-source tools often lack visibility and resources. However, OpenAI’s substantial token subsidy and the involvement of HackerOne suggest a commitment to broad impact.
Therefore, Patch the Planet represents more than a bug-fixing drive. It is an attempt to rebalance the relationship between AI and open-source security, turning AI from a threat into an ally. For maintainers, that shift cannot come soon enough.
For more insights, read about how AI changes cybersecurity or explore open-source tools for developers.
