Bringing Trail of Bits experts into OpenAI helps bridge the gap between the ultra-fast speed of AI models in discovering vulnerabilities and human capacity to patch them.
Early talks to acquire New York software security firm
Patch the Planet project partnership and Daybreak cyber initiative
Discovery of 858 software vulnerabilities and GPT-5.5 Cyber model capabilities
Building an integrated cybersecurity sector and easing the burden on developers
Frequently asked questions
Early talks to acquire New York software security firm
OpenAI is holding preliminary discussions to acquire Trail of Bits, a software security firm headquartered in New York City, according to a report published by The Information on Tuesday, October 13, 2026, citing people familiar with the negotiations.
Completing this deal would expand the growing business scope of ChatGPT developer OpenAI in the enterprise cybersecurity market, while the potential financial value of the transaction has not been disclosed.
Neither company has publicly confirmed these talks yet, and since discussions are still described as being in their early stages, reaching a final agreement is not yet certain.
Patch the Planet project partnership and Daybreak cyber initiative
The two companies have already been working together for several months; on June 22, 2026, they launched Patch the Planet, an open-source software security project under OpenAI’s broader cybersecurity initiative called Daybreak. OpenAI said in its announcement at the time that the project combines “AI-backed security research using our most capable models in the cyber domain with dedicated human review, not just to identify security vulnerabilities but to help patch and fix them.”
According to OpenAI, Trail of Bits dedicated its entire security research organization to the first batch of this project.
The company’s engineers examine the findings flagged by the models, write and test software patch packages, and coordinate responsible disclosure procedures with the developers managing each software project. Initial participants included core projects such as curl, the Go language project, Python, Sigstore, and the cryptography library.
Discovery of 858 software vulnerabilities and GPT-5.5 Cyber model capabilities
Trail of Bits wrote on its official blog that the first week alone of the project resulted in the discovery of hundreds of software bugs, alongside submitting 64 pull requests and opening 51 technical issues across 19 different projects. By July 20, the company’s public dashboard showed 858 potential vulnerabilities reported, 143 code patches merged into upstream sources, and 41 codebases reviewed.
The company also published detailed field reports regarding its work using OpenAI tools; one noted that the GPT-5.5 Cyber model successfully built a custom fuzzing campaign for the popular data compression library zlib in just one day, an engineering feat that previously took skilled researchers many weeks.
Trail of Bits also specializes in conducting security audits for major cryptocurrency and blockchain projects, including Uniswap, Aave, and Sam Altman’s Worldcoin project.
Building an integrated cybersecurity sector and easing the burden on developers
Buying Trail of Bits would bring a team of highly experienced human security researchers directly inside OpenAI, experts who currently verify and fix issues raised by AI models.
The Information described this move as part of OpenAI’s push to build a massive cybersecurity business, as AI models discover software vulnerabilities faster than the volunteers managing open-source projects can fix them.
OpenAI framed this gap as the problem Patch the Planet was built to solve, emphasizing that having security engineers triage findings before they reach maintainers reduces the burden on them rather than increasing it.
Frequently asked questions
Question: What is Trail of Bits, the company OpenAI is negotiating to buy?
Answer: It is a software security firm based in New York, known for discovering and fixing open-source software vulnerabilities and auditing projects like Uniswap and Worldcoin.
Question: What results did the joint Patch the Planet project achieve?
Answer: By July 20, the project successfully tracked 858 potential software vulnerabilities, merged 143 official code patches, and reviewed 41 open-source codebases.
Question: What did the GPT-5.5 Cyber model accomplish in Trail of Bits tests?
Answer: The model was able to build a custom fuzzing campaign to discover vulnerabilities in the zlib data compression library in just one day instead of weeks of human labor.
Question: Why does OpenAI need a team of human security researchers?
Answer: Because AI models discover vulnerabilities faster than open-source developers can fix them, so human experts triage the findings and write ready-to-use patches.
