OpenAI expands Daybreak with Patch the Planet and full GPT-5.5-Cyber release

OpenAI Group PBC today expanded its Daybreak cybersecurity program with a new open-source patching initiative called Patch the Planet, an updated Codex Security plugin, a partner program and the full release of its most capable defensive artificial intelligence model, GPT-5.5-Cyber.

The push marks a shift in how OpenAI talks about AI and security. The company says its models now find vulnerabilities faster than defenders can fix them, leaving security teams buried in reports. The new bottleneck, OpenAI says, is patching.

Patch the Planet is the centerpiece. Founded with security firm Trail of Bits Inc. and in collaboration with HackerOne Inc. and Calif, the initiative funds expert researchers and equips them with Codex Security and OpenAI’s models to work directly with the maintainers of widely used open-source projects. More than 30 projects have committed to taking part, with early participants including cURL, the Go project, Python, Sigstore and pyca/cryptography.

The pitch rests on how thinly stretched open source is. OpenAI cited research from the Linux Foundation and Harvard finding that 94% of the widely used projects studied had fewer than 10 developers responsible for more than 90% of the code added in a year. Throw more AI-generated bug reports at teams that small and the result is a bigger backlog, not better security. To avoid that, OpenAI said a human security engineer reviews every Patch the Planet finding before it reaches a maintainer.

An initial five-day sprint surfaced hundreds of issues and merged dozens of patches, OpenAI said, along with reusable fuzzing and testing tooling that projects can keep using. Trail of Bits put its entire security research organization on the effort and worked across 19 projects, according to OpenAI.

OpenAI also disclosed findings from the wider Daybreak work. Its models turned up a 23-year-old use-after-free flaw in OpenBSD’s kernel. On dnsmasq, Codex flagged patterns matching four of six dnsmasq vulnerabilities that were later assigned CVE numbers and fixed.

The browser results were sharper. In Chrome, OpenAI researchers reported five exploitable bugs in the V8 JavaScript engine. WebKit work on Safari turned up more than 10. The Firefox case had better timing: Mozilla patched a WebAssembly flaw, found with GPT-5.5, just two days before Pwn2Own Berlin. Five of the six Firefox entries registered for the contest then withdrew.

The full version of GPT-5.5-Cyber also went live, replacing a permissive-only preview. OpenAI put its CyberGym score at 85.6%, up from 81.8% for the standard GPT-5.5. The benchmark tests whether an agent can reproduce known vulnerabilities. Access stays restricted to vetted defenders through the company’s Trusted Access for Cyber program.

Rounding out the expansion is the Daybreak Cyber Partner Program. It lets security vendors and integrators wire GPT-5.5 with Trusted Access into the products they sell. Launch partners include Accenture plc, Cisco Systems Inc., CrowdStrike Holdings Inc., IBM Corp., Okta Inc., Palo Alto Networks Inc. and Wiz Inc.

The timing is notable. Rival Anthropic PBC has seen its own cyber-capable models sidelined, leaving OpenAI room to press its case. The company said it is continuing to work with the U.S. government on pre-deployment testing and has signed Trusted Access partnerships with Australia, Canada, France, Germany, Japan, South Korea and European Union institutions over the past month.

Codex Security has scanned more than 30 million commits across more than 30,000 codebases since its research preview launched in March, OpenAI said, with human reviewers marking more than 70,000 findings as fixed.

Image: OpenAI