OpenAI launches new initiative to help find and patch open-source bugs

OpenAI unveiled a new program on Monday aimed at strengthening the defenses of open-source software, marking the company's latest push to apply its artificial intelligence tools to real-world cybersecurity problems rather than just chatbots and coding assistants.

The effort, called "Patch the Planet," borrows its name from "Hack the Planet," the rallying cry made famous by the 1995 film Hackers. Despite the playful branding, the initiative addresses a serious and long-standing problem: much of the internet's infrastructure runs on open-source code maintained by small, often unpaid teams who lack the resources to hunt down vulnerabilities before attackers do.

To carry out the work, OpenAI is partnering with Trail of Bits, an established cybersecurity firm known for auditing software used across the tech industry. Under the arrangement, Trail of Bits engineers will embed directly with open-source project maintainers, combing through codebases to flag weaknesses that could be exploited.

OpenAI said its own security-focused technology will support that review process, singling out Codex Security — a variant of its coding-assistant product tailored to spotting flaws — as a key part of the toolkit. The pairing reflects a broader industry bet that large language models can scan sprawling codebases faster than human reviewers alone, surfacing issues that might otherwise go unnoticed for years.

The stakes around open-source security have grown sharper in recent years. Vulnerabilities buried in widely used but thinly staffed libraries have repeatedly rippled outward to affect banks, government agencies and major corporations, since so much commercial software quietly depends on the same free, community-maintained building blocks. Maintainers frequently describe being overwhelmed, volunteering nights and weekends to patch problems in tools used by billions of devices worldwide.

By pairing professional auditors with AI-assisted scanning, OpenAI and Trail of Bits are betting they can compress the time it takes to find and fix such flaws, potentially heading off incidents before they escalate into the kind of supply-chain crises that have alarmed security researchers in the past. It also gives OpenAI a tangible showcase for Codex Security beyond internal use, at a moment when rivals are racing to prove their own models can handle serious, high-stakes engineering tasks rather than routine code generation.

Even so, questions remain about how far the program will reach and how it will be judged. OpenAI has not detailed which projects will be prioritized, how many maintainers will be involved, or how the initiative's impact will be measured over time. Security researchers have also cautioned more broadly that AI-assisted code review can produce false positives or overlook subtle logic flaws, meaning human oversight from firms like Trail of Bits is likely to remain essential rather than optional as the effort expands.

Source: TechCrunch