Patch the Planet
Securing the open-source software the world runs on
Trail of Bits security engineers work directly with open-source projects to find bugs, write patches, and raise each project's resilience against real-world attacks.
- Python
- PyPI
- cURL
- Let's Encrypt
- NATS
- Valkey
- Sigstore
- RustCrypto
- aiohttp
- urllib3
- freenginx
- SimpleX
- Go
- Ansible
- SciPy
- Open Quantum Safe
- mlkem-native & mldsa-native
The latest
Follow the work
Every issue found, patch submitted, and fix merged upstream across all open-source codebases under review, plus announcements and field reports as they publish.
- 46 Codebases under review
- 1,137 100% Issues found reported
- 866 76% Awaiting patch reported + confirmed
- 271 24% Patch written fix authored
- 125 11% Patches open fix open upstream
- 146 13% Patches accepted merged upstream
GPT-5.5-Cyber built a zlib fuzzing lab in a day
A Patch the Planet field report: GPT-5.5-Cyber built a bespoke zlib fuzzing campaign in a single day, work that once took skilled researchers weeks.
Introducing Patch the Planet
Patch the Planet is our joint initiative with OpenAI to assist critical open-source software in the age of machine-speed vulnerability research.
Patch the Planet
OpenAI on the initiative and why securing open-source software matters for everyone.
Daybreak: Securing the world
The broader Daybreak cybersecurity effort that Patch the Planet is part of.
In the press
Coverage from around the industry
OpenAI wants AI to fix vulnerabilities, not just find them
OpenAI launches new initiative to help find and patch open source bugs
OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic's Mythos
OpenAI rolls out more capable version of cyber model
OpenAI's new Daybreak initiative will help open-source projects fend off bugs
OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery
OpenAI rolls out AI-led push to fix open-source software flaws
OpenAI expands Daybreak with Patch the Planet and full GPT-5.5-Cyber release
Apply
Bring Patch the Planet to your project
Maintain something the world depends on? Tell us about your project. Selected maintainers get a week of dedicated security engineering, patches included.
What maintainers get
- 1
A week of dedicated review
A Trail of Bits engineer spends a full week on your codebase, finding and triaging bugs across the areas that matter most to your project.
- 2
Patches, not just findings
We write and submit fixes, and help improve your project's security tooling and readiness for agentic workflows.
- 3
Six months of ChatGPT Pro
Selected maintainers receive six months of ChatGPT Pro from OpenAI, including conditional Codex security access for coding, automations, and workflows.
Apply to Patch the Planet
Tell us about your project. The form takes a couple of minutes.
