OpenAI has launched Patch the Planet, an initiative that points artificial intelligence at the security holes in open-source software, alongside an upgraded model called GPT-5.5-Cyber built to find and fix them. Announced on June 22 as an expansion of OpenAI's Daybreak cybersecurity platform, the new model is the company's strongest yet for vulnerability work while keeping GPT-5.5's general intelligence. It scored 85.6 percent on the CyberGym benchmark, up from 81.8 percent for GPT-5.5, and OpenAI is opening it to vetted security researchers.
Patch the Planet is the part that matters most. Founded with the security firm Trail of Bits and run in collaboration with HackerOne, outside researchers, and the maintainers themselves, it is built to move widely used open-source projects from findings to fixes. The pitch is a full defensive loop rather than just bug-hunting: discovery, validation, severity review, disclosure, patch development, testing, and deployment. Finding the bug is the easy part, and the program is explicitly trying to carry a fix all the way to shipped.
The early results are concrete, and so is the list of who is in. More than 30 open-source projects have committed to participate, with initial members including cURL, Go, Python, Sigstore, and pyca/cryptography, the kind of foundational code that quietly runs almost everything online. In the first week, Trail of Bits engineers working full-time alongside Codex and GPT-5.5-Cyber surfaced hundreds of bugs and filed 64 pull requests and 51 issues across 19 projects, with dozens of patches already merged. This is not a staged demo.
The bet underneath the program is pointed. AI has made finding vulnerabilities cheap, which helps attackers at least as much as defenders, and OpenAI's wager is to put that same capability on the maintainers' side of the fight. The open-source code that runs the internet is chronically under-resourced, often a handful of volunteers maintaining libraries the entire world depends on, and if AI can take on the grunt work of triage and patch drafting, those defenders get leverage they have never had.
The honest caveat is that a pull request is not a merge. Hundreds of bugs and 64 PRs is a strong opening, but patches still need maintainer review, and flooding volunteer maintainers with AI-generated findings can be a burden as easily as a gift if the signal-to-noise is wrong. Carrying the full loop to deployment is the hard part, and the real test is months of merged, regression-free fixes rather than a first-week tally. Still, the direction is hard to argue with. Of all the things to aim a strong cyber model at, hardening the shared infrastructure everyone relies on is near the top of the list.