OpenAI has announced a new cybersecurity initiative called Patch the Planet, partnering with security firm Trail of Bitsto help open source software maintainers identify and fix vulnerabilities in their codebases using AI-powered tools.
Under the programme, security engineers from Trail of Bits will work directly with open source project maintainers, reviewing potential code issues before they are escalated, developing patches and tests, and building reusable workflows that projects can continue using after initial fixes are applied. OpenAI’s own security tooling, including Codex Security, will support the process throughout.
The initiative targets a well-documented structural weakness in the software industry. Open source projects form the foundational layer of most commercial software, yet many are maintained by small teams with limited time and resources. Vulnerabilities in widely used open source utilities, such as the critical log4j flaw discovered several years ago, can cascade into serious security failures across the entire commercial software ecosystem.
The launch arrives in the context of growing concern about AI’s potential to automate the identification and exploitation of software vulnerabilities, a capability associated with Anthropic’s heavily restricted Mythos model. OpenAI’s programme inverts that dynamic, directing similar AI capabilities toward defence rather than exploitation. The initiative represents both a genuine contribution to open source security and a pointed competitive signal aimed at Anthropic at a moment when the latter’s most powerful models remain off the market.
