On June 22, 2026, Daybreak announced Patch the Planet, an initiative built with Trail of Bits to help maintainers shore up widely used open-source software. The program combines AI-assisted security research using cyber-focused models with expert human review to validate findings, develop patches, and coordinate disclosure.
How the program operates
Each engagement begins with consultation between security engineers and maintainers to determine priorities—vulnerability validation, patch development, CI/CD improvements, or longer-term security engineering. Researchers then investigate potential flaws, validate issues, develop or refine patches and tests, and coordinate disclosure via the project’s established channels.
Trail of Bits committed its security research organization to the initial surge and reviews every finding before it reaches a maintainer. The initiative also involves HackerOne and Calif for triage, coordinated disclosure, and focused discovery.
Early work and tools
Trail of Bits has worked full-time with Codex and GPT‑5.5‑Cyber across 19 open-source projects, reporting that teams identified hundreds of security issues and merged dozens of patches, with additional items under coordinated disclosure. The sprint produced test harnesses, historical-CVE analysis pipelines, differential-testing systems, threat models, expanded test suites, and workflows for deduplication and false-positive filtering.
Examples cited include building a fuzzing lab in under a day using repeated Codex runs with GPT‑5.5‑Cyber, and an end-to-end pipeline that ingests historical CVEs to search for related flaws and prioritize candidates for human review. Differential testing and property-based tests derived from specifications were also automated to surface behavioral divergences between implementations.
Participating projects in the initial round include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python, and python.org. Participating teams receive access to ChatGPT Pro, conditional access to Codex Security, and API credits for development and automation.
The announcement lists specific findings across the stack: Linux Kernel PoCs (8 pointer-leak PoCs and 24 local privilege escalation exploits), a 23-year-old OpenBSD use-after-free, confirmed FreeBSD vulnerabilities (34 confirmed, 7 LPE PoCs), dnsmasq CVEs (CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-5172), an “HTTP/2 Bomb” affecting NGINX, Apache, IIS and Pingora, and browser issues including Chrome V8 and WebKit work. A WebAssembly vulnerability (CVE-2026-8390) was identified in Firefox ahead of Pwn2Own Berlin.
Maintainers retain control over which patches are deployed and how disclosure is handled. Maintainers may apply to join Patch the Planet.
Original source: OpenAI News