Patch the Planet: a Daybreak initiative to support open source maintainers

June 22, 2026

We are introducing Patch the Planet, a Daybreak initiative built with Trail of Bits to help maintainers strengthen the critical open-source software the world relies on. We’re pairing AI-assisted security research using our most cyber-capable models with expert human review to not only identify vulnerabilities, but help patch them.

AI is accelerating vulnerability discovery, but discovery alone does not protect users. Many maintainers are already being asked to sort through more reports, more quickly, with the same limited time and resources. Patch the Planet is built to reduce that burden, not add to it: security engineers review findings before they reach maintainers, work with projects to develop patches and tests, and build reusable workflows that help teams continue improving security after the first fixes land.

Trail of Bits has committed their entire security research organization towards this effort for our initial surge. They are working directly with maintainers to investigate and validate vulnerabilities, develop and test patches, and coordinate disclosure of vulnerabilities.

Additionally, we will be partnering with HackerOne and Calif who are helping us take our efforts further with vulnerability triage, coordinated disclosure, and additional focused vulnerability discovery efforts.

How Patch the Planet works

Each engagement under Patch the Planet begins in consultation with the maintainer. For each collaboration, security engineers work with maintainers to understand each project’s needs, preferences, and where additional security effort would be most useful: vulnerability validation, patch development, CI/CD improvements, or longer-term security engineering. Once aligned, researchers investigate potential vulnerabilities, validate meaningful issues, develop or refine patches, support testing, and coordinate disclosure through the project’s established channels.

Initial participants include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python, and python.org. These projects support widely used networking, cryptography, software supply chain, and language infrastructure, where stronger security can benefit a broad range of downstream products and services. Additional projects will join in future rounds.

Security researchers are equipped with our frontier models as well as Codex Security to support the analysis, patch development, testing, and documentation. Participating projects receive access to ChatGPT Pro; conditional access to Codex Security; and API credits for core open-source development, maintainer automation, and release workflows.

Early field notes and findings

Trail of Bits has dedicated security engineers to work full-time with Codex and GPT‑5.5‑Cyber across 19 open-source projects, and has already identified hundreds of security issues and merged dozens of patches, with many more still undergoing coordinated disclosure.

Operating systems

• Linux Kernel: GPT‑5.5‑Cyber identified security-relevant components across more than 30 million lines of code, flagged potential security issues, and then validated them dynamically, generating 8 kernel pointer information leak proof-of-concepts (PoCs) and 24 local privilege escalation exploits.
• OpenBSD: Models identified a 23-year-old use-after-free in OpenBSD’s kernel implementation of System V semaphores.
• FreeBSD: Calif used Codex to find and validate LPEs; OpenAI researchers confirmed 34 vulnerabilities and produced 7 local privilege escalation PoCs.

Network

• dnsmasq: Codex Security independently identified vulnerable patterns corresponding to four of the six dnsmasq CVEs later fixed in 2.92rel2.
• HTTP/2 Bomb: Calif used Codex to identify a denial-of-service technique affecting major HTTP/2 implementations including NGINX, Apache, IIS and Pingora. Analysis suggested that more than 880,000 Internet-facing websites were running affected server software with HTTP/2 enabled.

Browsers

• Chrome: Five exploitable vulnerabilities in Chrome’s V8 JavaScript engine, including three remediated within days of being introduced.
• Safari: In roughly a week of focused WebKit work, over 10 exploitable Safari vulnerabilities were found and reported.
• Firefox: OpenAI Preparedness identified a WebAssembly vulnerability (CVE-2026-8390) with GPT‑5.5 during safety evaluations that Mozilla patched two days before Pwn2Own Berlin, prompting five of six registered Firefox entries to withdraw.

Security engineers reviewed every finding before it reached a maintainer. Trail of Bits engineers manually reviewed every security issue before submission to maintainers to filter false positives, remove duplicates, reassess severity, and prioritize confirmed vulnerabilities for remediation.

Additional reporting

InfoWorld (June 23, 2026): Analysts said Patch the Planet changes the risk equation only if enterprises treat AI-assisted vulnerability research as an input to a broader software supply chain risk program. Forrester’s Biswajeet Mahapatra noted the key shift is speed while human reviewers reduce false positives. The focus follows incidents such as Log4Shell and the XZ Utils backdoor.