OpenAI’s “Patch the Planet” wants to fix open-source bugs before they blow up

OpenAI announced a new initiative on Monday called “Patch the Planet.” Yes, it’s a nod to Hackers (the 1995 movie, not the TV show). The idea is straightforward: pair OpenAI’s security tools with Trail of Bits’ security engineers to help open-source maintainers find and fix bugs before they become disasters.

Here’s how it works on paper. Trail of Bits engineers will review code issues flagged by OpenAI’s tools like Codex Security, then work directly with maintainers to develop patches and tests. OpenAI says the goal is to reduce the burden on maintainers, not add to it. “Security engineers review findings before they reach maintainers, work with projects to develop patches and tests, and build reusable workflows that help teams continue improving security after the first fixes land.”

That’s the theory. In practice, it’s basically a triage service: code EMTs backed by AI. The engineers handle the initial noise, prioritize what matters, and hand off actionable fixes. It sounds great, but I’m skeptical about how this scales. Open source is massive. There are thousands of projects, many of them understaffed or abandoned. Even with AI assistance, human reviewers are a bottleneck. OpenAI hasn’t said how many projects they plan to cover, or for how long.

Still, the need is real. Open-source software is the foundation of the commercial software industry, and it’s notoriously insecure. The log4j mess from a few years ago is a textbook example: one bad vulnerability in a widely used logging utility turned into a global incident. The decentralized nature of open source means bugs can linger for years before anyone notices.

There’s also the competitive angle here. Anthropic’s Mythos tool has been making headlines for its ability to automatically find and exploit vulnerabilities. That’s a legitimate concern — AI can now weaponize bugs faster than ever. OpenAI is essentially flipping the script: use the same kind of automation to help defenders instead of attackers. It’s hard not to read this as a direct response to Anthropic, but honestly, the open-source community needs all the help it can get.

The initiative is still early. No word on long-term plans, funding, or how they’ll decide which projects get attention. But it’s a step in the right direction. If they can prove the model works on a handful of critical projects, maybe it’ll grow into something bigger. For now, I’ll take it as a rare case of AI being used for something genuinely useful instead of just generating marketing copy.