OpenAI launched Patch the Planet under its Daybreak initiative. The program helps open-source maintainers find, validate, and fix vulnerabilities. It pairs AI models with expert human review from Trail of Bits. HackerOne and Calif are also partners for triage and disclosure. Initial projects include cURL, NATS Server, pyca/cryptography, and Python. Participants get access to ChatGPT Pro, Codex Security, and API credits. Trail of Bits built AI workflows for deduplication, triage, and patching. Researchers already identified hundreds of issues and merged dozens of patches. Findings span operating systems, network software, and browsers. Maintainers retain control over patches and disclosure. OpenAI plans to publish deeper technical reports as fixes land. Maintainers can apply to join the program.
What changed
Open-source maintainers handled vulnerability reports without AI-assisted triage or patch development support.
What it unlocks
AI-assisted discovery, validation, patching, and disclosure of vulnerabilities in critical open-source projects at scale.
- 19 open-source projects in initial sprint
- hundreds of security issues identified
- dozens of patches merged
- 880,000+ websites affected by HTTP/2 Bomb
What you need to act on it
- maintainer consultation and alignment
- coordinated disclosure process
- project participation in Patch the Planet
Sources