On June 22, 2026, OpenAI launched Patch the Planet — an initiative that uses its own cybersecurity model to find and fix vulnerabilities in the major open-source projects the internet depends on.
In one week: 51 real bugs found, 19 already fixed.
The Project
Patch the Planet is part of OpenAI's Daybreak program, built in partnership with Trail of Bits (one of the industry's most respected security teams), HackerOne, and Calif.
The technological core is GPT-5.5-Cyber, OpenAI's AI model optimized for cybersecurity. The model set a new benchmark of 85.6% on CyberGym, the reference dataset for evaluating vulnerability-analysis capabilities.
But the most important element of the project isn't the model — it's the hybrid process:
- GPT-5.5-Cyber analyzes the code of open-source projects, looking for vulnerability patterns
- Trail of Bits security engineers manually verify every finding before it reaches the maintainers
- Only confirmed vulnerabilities get reported, with patches and tests already developed
- The team helps maintainers integrate the fixes and builds reusable workflows for ongoing monitoring
The Projects Involved
The choice of projects isn't random — they're among the most widely used libraries and tools in the world:
- cURL — the data-transfer tool used in nearly every operating system and web application
- Python — the language behind most of AI, data science, and the modern web
- Go — the language behind Docker, Kubernetes, and much of cloud infrastructure
- aiohttp — a widely used asynchronous HTTP library for Python
- freenginx — a fork of nginx, one of the most widely used web servers
- Sigstore, pyca/cryptography, NATS Server — critical components for security and messaging
Vulnerabilities in these projects don't just affect those using them directly — they affect every system and application built on top of them.
The First Week's Results
In the first week, working across 19 projects, the team:
- Identified hundreds of suspicious patterns in the code
- Confirmed 51 real vulnerabilities
- Fixed 19 of these vulnerabilities, with patches already merged
Why This Initiative Matters
Open source is the internet's invisible infrastructure. Every website, every application, every cloud service depends to some extent on open-source libraries often maintained by small teams or individual volunteer developers with limited resources.
The security of this infrastructure is a structural problem: maintainers don't always have the resources to conduct in-depth security audits, and vulnerabilities can stay hidden for years. The Log4Shell incident of 2021 — a vulnerability in a Java library used by millions of applications — is the best-known example of how devastating a flaw in a widely used open-source component can be.
OpenAI's approach — using AI to find bugs quickly, with human oversight to validate them — is exactly the kind of application where AI's advantage in processing large volumes of code combines with the human judgment needed to distinguish real problems from false positives.
Patch the Planet doesn't solve open source's structural understaffing problem. But it's a concrete contribution — and it shows AI can be a genuinely useful tool for software security, not just a risk.