Radar / AI security / OpenAI Patch the Planet
OpenAI Patch the Planet: coordinated disclosure program for AI-discovered vulnerabilities
OpenAI launched Patch the Planet, an initiative with Trail of Bits that coordinates security researchers, open-source maintainers, and incident responders to fix critical vulnerabilities found by AI agents before attackers exploit them.
Why it matters
AI agents found two critical PHP remote-code-execution bugs affecting ~70% of websites before attackers did, and OpenAI coordinated a two-month Defender's Window plus a $1B Daybreak commitment — turning frontier models into active cyber defense.
What you could build with it
A security startup can build a managed service that pairs frontier coding agents with human triage teams to continuously scan popular open-source dependencies and coordinate responsible disclosure, selling the Defender's Window as a subscription to enterprises.
Does it hold up?
Too early to judge as a program — the first coordinated disclosure (two PHP RCE CVEs) completed, but details leaked early and the PHP team had to rush patches a day ahead of schedule; the real test is whether the next disclosure holds.
Built with OpenAI Patch the Planet
- PHP's flaws show the stakes of AI's cyber racethedeepview · Covers CVE-2026-109618/109619: memory-corruption RCE bugs in PHP found by AI agents before attackers, with a two-month coordinated Defender's Window.
- OpenAI-led AI agents uncover critical PHP flaws, prompting coordinated global patch effortlordofclaude · Notes Patch the Planet is a joint effort between OpenAI and Trail of Bits, plus OpenAI's $1B Daybreak subsidy for frontline defenders.
- OpenAI discovers two critical PHP vulnerabilities, allocates $1 billion for Daybreak Initiativekucoin · Calif found one bug with GPT-5.6 Sol; Wiz found both independently with Gemini 4 Argon + GPT-5.6 Sol; OpenAI shipped a PHP version-checker as a Codex skill.
Learn more
First spotted on article: source.
More AI security
iFixAi: independent auditing of AI agentsIndependent AI-agent auditor: 250+ inspections across 69 misalignment categories (red teaming + operational assurance)…security · JEV 0.76Cloudflare security-audit-skill: six-phase agent-driven security audits with independently verified findingsOpen-source MIT coding-agent skill that runs a codebase through six audit phases — reconnaissance, coverage-led…security · JEV 0.74OpenAI, Anthropic and Google DeepMind jointly unveil cyber-focused safety models and safeguardsThe three rival labs disclosed weeks of behind-the-scenes coordination and jointly released a set of cyber-focused AI…security · JEV 0.73OpenAI textGrain watermarking for ChatGPT and Codex in the EUOpenAI will roll out its invisible textGrain watermarking system to ChatGPT/Codex users in the EU over the coming…security · JEV 0.65Cloudflare security-audit-skill: multi-phase security audits for coding agentsA coding-agent skill that runs multi-phase security audits with independently verified, machine-checkable findings.security · JEV 0.63LiveNerf: a pre-registered benchmark for post-release model driftOpen-source, pre-registered 30-day benchmark that detects whether Claude Opus 5.5 quietly gets worse after launch.security · JEV 0.61
Get the week's best AI launches, plus 3 ideas worth building
One email every Saturday. Ranked by traction, not hype. Free.