The traditional security researcher move is to find a bug, write a strongly worded disclosure, and let some poor maintainer lose a weekend fixing it. OpenAI's new approach skips the strongly worded part and just... fixes the bug itself. Then tests the fix. Then moves on to the next one, like a very polite, very tireless intern who never asks for a raise.

From "You've Got a Bug" to "Also, Here's the Fix"

OpenAI has expanded its Daybreak program with GPT-5.5-Cyber, described as the company's strongest model yet for finding and helping patch software vulnerabilities, scoring 85.6% on the CyberGym benchmark versus 81.8% for standard GPT-5.5. Alongside it comes Patch the Planet, a companion initiative built with Trail of Bits to help open-source maintainers go from "here's a finding" to "here's a shipped fix" — the unglamorous, unpaid work that keeps the internet's plumbing from rusting through.

More than 30 open-source projects have signed on, including cURL, Go, Python, Sigstore, pyca/cryptography, NATS Server, aiohttp, and freenginx — the kind of unglamorous dependencies that half the internet quietly runs on without ever thinking about. Access to the full model is restricted to vetted defenders through OpenAI's Trusted Access for Cyber program, which loosens the model's usual safety refusals for approved defensive work while still blocking anything resembling credential theft, stealth, or malware deployment.

The Software Holding Up the Internet Gets a Tune-Up

Daybreak has already been busy: scanning over 30 million lines of the Linux kernel, it flagged issues that led to 8 kernel pointer information-leak proofs-of-concept and 24 working local privilege-escalation exploits. It also surfaced 34 FreeBSD vulnerabilities, an "HTTP/2 Bomb" affecting NGINX, Apache, and IIS, and browser bugs in Chrome's V8 engine, Safari, and Firefox's WebAssembly implementation.

Here's the part worth sitting with: a model capable enough to responsibly patch code is, by definition, capable enough to write the exploit first. OpenAI's own numbers prove it — 24 working privilege-escalation chains is not a hypothetical capability, it's a demonstrated one, currently pointed at defense because access is gated and the incentives are aligned. That gate, and the trust placed in whoever holds the keys to it, is doing a lot of load-bearing work for the whole plan.

Open-source maintainers have spent decades being the internet's unpaid janitors. If this actually ships working patches instead of just more GitHub issues, it might be the first AI security story in a while that ends with someone getting a full night's sleep.

Source: The Hacker News