Patch the Planet expands coordinated disclosure for critical open source bugs

OpenAI's Patch the Planet initiative was presented as a coordinated response to critical open-source vulnerabilities, linking security researchers, maintainers and incident responders to move findings toward validation and remediation rather than leaving them as uncategorized bug reports.

Evidence and context

According to the source material published on Wed, 21 Oct 2026, Patch the Planet is framed as a way to help address critical vulnerabilities across open source. The broader program was announced on June 22, 2026 as a joint effort involving OpenAI and Trail of Bits within OpenAI's Daybreak cybersecurity initiative. Background material describes it as a security assistance program rather than a standalone commercial platform, with selected projects receiving a week of dedicated Trail of Bits security engineering and six months of ChatGPT Pro, including conditional Codex security access.

Trail of Bits said the program is intended to help maintainers cope with machine-speed vulnerability discovery by supplying expert validation, patches and workflow improvements. HackerOne, named as a launch partner alongside Trail of Bits and Calif, said it provides shared intake, triage, remediation tracking and coordinated disclosure through its H1 Platform. HackerOne also said OpenAI funds the program and that participating maintainers retain control of their projects.

As of 21 Oct 2026, the program's official dashboard showed 68 codebases under review, 1,995 issues found, 679 patches written and 466 patches accepted upstream. Those figures were program-reported and were not described as independently audited metrics.

Related Trail of Bits posts dated 28 Jul 2026 and 26 Aug 2026 suggest the initiative has also been used to examine how to find bugs in Patch the Planet and how cyber-capable agents are handled in virtual machines, but those posts are supporting context rather than direct evidence of the latest announcement.