OpenAI expands AI use to protect software, faces challenge of implementing fixes
1–2 minutes
OpenAI is expanding its cybersecurity efforts using artificial intelligence. The Daybreak program, announced in August, aims to protect digital infrastructure, but the speed at which problems are identified has revealed a new challenge: turning findings into reliable, implemented fixes.
A practical example is Patch the Planet, developed in partnership with Trail of Bits to support open-source projects. As of the panel update on Sunday, 25, there were 1,995 findings recorded across 68 projects, 1,316 of which were still awaiting a solution. To date, 679 patches have been written, with 466 accepted by maintainers.
Why human review remains essential
In June, OpenAI explained that experts replicate issues, eliminate duplicates, and test changes before maintainers evaluate the proposals. Project maintainers retain control over implementing changes and disclosing vulnerabilities.
Generating a patch doesn’t mean protection is complete. The code must fix the flaw without affecting other functions. This distinction is evident in recent cases where websites were taken offline as a precaution after vulnerabilities were discovered.
An internal Trail of Bits study published on October 21 identified 21 regressions in over 130 already implemented changes: 16 were functional, one was performance-related, and four were related to compilation or testing. None compromised security protections, according to the company.
How access to defense tools works
Daybreak offers two access options: the Blue version for general defense and the Red version for authorized security research using more advanced models. Access is restricted to verified organizations.
OpenAI also announced a $1 billion commitment to provide subsidized access for six months, targeting essential services and resource-constrained organizations. The offer provides access to tools rather than transferring funds to entities.
Frequently Asked Questions
Are all 1,995 findings critical flaws?
No. The number represents the total findings recorded on the Trail of Bits panel, without a uniform severity classification.
Who decides whether a fix is implemented in the project?
Maintainers evaluate proposals and control their implementation, following the workflow defined by OpenAI.
Is the subsidy a cash donation?
The commitment is for subsidized access to tools, not a transfer of $1 billion to a foundation.
