OpenAI is holding preliminary discussions to buy Trail of Bits, a security-research firm that finds and fixes vulnerabilities in open-source software, The Information reported on 13 October, citing people familiar with the matter. The value of a potential deal is unknown, and the talks may not result in a deal, the people said, according to Crypto Briefing’s account of the report.
The two companies already work together. In June OpenAI launched Patch the Planet, which it describes as an initiative “built with Trail of Bits” that pairs its most cyber-capable models with human review to find and patch bugs in open-source projects.
Business Pill · THE AI AUDIT PROBLEM
A Business Engineer explainer on why checking AI-made work can cost more than making it. It explains the concept in general and says nothing about OpenAI or Trail of Bits.
The key insight: As we read it, what OpenAI would be buying is the review step around its models: OpenAI’s own Patch the Planet post says Trail of Bits engineers manually reviewed every security issue before it reached a maintainer, and built reusable workflows for deduplication, triage and patching.
According to Crypto Briefing’s account, The Information said the talks come as OpenAI seeks to develop a substantial cybersecurity business. Neither OpenAI nor Trail of Bits has commented publicly on the report in the sources we read.
On 16 October The Information wrote on X that OpenAI “could deepen its cybersecurity capabilities by acquiring Trail of Bits, whose engineers have used Codex to find and fix bugs in open-source projects such as Python.”
Crypto Briefing describes Trail of Bits as a New York firm that provides security audits, adversarial testing, vulnerability discovery and security engineering tools, and says it has audited crypto projects such as Uniswap, Aave and Worldcoin.
Patch the Planet’s first week as Trail of Bits reported it on 22 June 2026: 64 pull requests, 51 issues filed, 37 patches merged and 19 issues closed with a fix, across 19 open-source projects. Trail of Bits says the public tally undercounts the work because several projects take reports through private channels.
What Was Posted on X
OpenAI could deepen its cybersecurity capabilities by acquiring Trail of Bits, whose engineers have used Codex to find and fix bugs in open-source projects such as Python.
The Information wrote on X on 16 October that OpenAI could deepen its cybersecurity capabilities by acquiring Trail of Bits, whose engineers have used Codex on open-source projects such as Python. It links to its paywalled report of preliminary talks.
What the Two Companies Built Together
OpenAI’s Patch the Planet post says Trail of Bits “has committed their entire security research organization” to the initial effort. It says Trail of Bits engineers worked full-time with Codex and GPT-5.5-Cyber across 19 open-source projects and identified hundreds of security issues, with dozens of patches merged.
Trail of Bits wrote on 22 June that the first week produced 64 pull requests and 51 issues across 19 projects, and that 37 patches were already merged. It named projects including cURL, the Go project, Python and python.org, PyPI and Sigstore, and said over 30 projects had committed to join.
In one example, OpenAI says Trail of Bits engineers used repeated Codex runs with GPT-5.5-Cyber to build a fuzzing lab in less than a day, work that Trail of Bits estimates would ordinarily take at least several weeks by hand. OpenAI also says Trail of Bits engineers manually reviewed every security issue before it was submitted to a maintainer.
Where It Fits in OpenAI’s Security Push
Patch the Planet is part of OpenAI’s Daybreak program. The same post lists findings beyond the projects Trail of Bits worked on, including a 23-year-old use-after-free in OpenBSD’s kernel and 34 confirmed FreeBSD vulnerabilities across a broader campaign.
As we read it, the two companies already depend on each other: OpenAI describes Patch the Planet as “built with Trail of Bits”, and The Information wrote that Trail of Bits engineers “have used Codex to find and fix bugs in open-source projects such as Python.”
As we read it, the bottleneck the posts describe is checking findings, not producing them: OpenAI says frontier models produce a high volume of false positives, and Trail of Bits wrote that “Finding the bugs is now the easy part”.
As we read it, nothing about the deal is settled: The Information reported preliminary talks, an unknown value and a deal that may not happen, according to Crypto Briefing’s account.
The Information on X, 16 October 2026
“OpenAI could deepen its cybersecurity capabilities by acquiring Trail of Bits, whose engineers have used Codex to find and fix bugs in open-source projects such as Python.”
Three Implications
OPEN-SOURCE MAINTAINERSOpenAI says projects in Patch the Planet receive ChatGPT Pro, conditional access to Codex Security and API credits, and that Trail of Bits engineers review findings before they reach maintainers.
SECURITY FIRMS The Information reported that OpenAI is seeking to develop a substantial cybersecurity business, according to Crypto Briefing’s account of the report.
TEAMS USING AI FOR SECURITY WORK Trail of Bits wrote that the first week of Patch the Planet produced 64 pull requests and 51 issues across 19 projects, and that its public tally undercounts the work.
The framework argues that “The Judgment Layer is now empirical, not theoretical. As execution delegates, humans relocate to delegation, oversight, and integration; returns to domain expertise rise.”
As we read it, Trail of Bits sits in that judgment layer: OpenAI’s post says its engineers reviewed every finding before it reached a maintainer. The framework was published in July 2026 and does not discuss Trail of Bits.
What Is Not Established
The reported talks are preliminary, no price or structure was reported, and neither company has confirmed them in the sources we read. The Information’s article is paywalled; we relied on Crypto Briefing’s account of it and on The Information’s post on X.
A note on sourcing. The report of talks comes from The Information, whose article is paywalled; we relied on Crypto Briefing’s account of it and on The Information’s post on X. Background on Patch the Planet comes from OpenAI’s and Trail of Bits’ own posts. We did not contact either company. The references to our earlier reporting link to our own pieces.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur, HackerNoon and Search Engine People. Find him on LinkedIn and Substack. See how we source.
Scroll to Top
Discover more from FourWeekMBA
Subscribe now to keep reading and get access to the full archive.
