News

OpenAI announced that it is making an enhanced GPT-5.5-Cyber model available to vetted defenders as part of its Daybreak effort. The company described the release as its most capable model yet for locating software security flaws and assisting with fixes: it can perform sustained, in-depth analysis across large codebases, confirm vulnerabilities inside controlled test environments, and produce and validate patches.

Alongside the model, OpenAI said it is shipping an updated version of the Codex Security plugin. The company says the plugin accelerates both discovery and remediation of vulnerabilities in deployed systems and helps prevent new weaknesses from making it into production. According to OpenAI, developers can use the tools to run comprehensive scans or examine recent commits, produce reports that include severity ratings, affected code locations, validation evidence and remediation advice, map potential attack paths, construct threat models, validate findings, and create codebase-specific patches ready for human review.

OpenAI added that the plugin can also triage and validate previously identified issues coming from scanners, advisories, bug-bounty submissions or ticketing systems, then help generate patches at scale to clear backlogs of unresolved vulnerabilities.

In parallel with those product updates, OpenAI is launching a new program called Patch the Planet in collaboration with security firm Trail of Bits to bolster the security of open-source projects. Initial participants named by OpenAI include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python, and python.org.

The push comes as advanced models from the likes of Anthropic and OpenAI themselves have sped up the pace of vulnerability discovery, leaving many maintainers struggling to keep up with the growing queue of bugs that must be verified, triaged and patched. Where finding flaws used to be the main hurdle, the bottleneck has increasingly become producing and deploying fixes. Modern AI models can traverse sprawling codebases, reason about attack chains and surface security issues that might otherwise remain buried – a recent example being a 29-year-old vulnerability in the Squid web proxy (CVE-2026-47729, dubbed Squidbleed) that can expose other users’ cleartext HTTP requests under certain conditions.

Security professionals have warned that the same AI advances also lower the barrier for malicious actors to weaponize newly discovered issues. In guidance published in May 2026, the Canadian Centre for Cyber Security warned that threat actors with modest technical skill can leverage public AI models for harmful purposes and that organizations should assume AI-enabled exploitation may circumvent preventive controls, outpace vendors’ ability to publish fixes, and strain defenders’ deployment capabilities.

Patch the Planet is intended to relieve some of that pressure by connecting security engineers with maintainers to review and validate findings, co-develop patches and tests, and create reusable vulnerability discovery workflows so projects remain safer beyond the initial remediation. OpenAI said the initiative will work with researchers, maintainers, enterprises and partners to make potent defensive capabilities available to authorized defenders with appropriate governance and human oversight.

OpenAI also said Daybreak has already contributed to discovering numerous vulnerabilities across operating systems and browsers, including:

• Eight kernel pointer information-leak proofs-of-concept and 24 local privilege escalation exploits in the Linux kernel.
• A 23-year-old use-after-free in OpenBSD’s kernel implementation of System V semaphores.
• Thirty-four vulnerabilities and seven local privilege-escalation proofs-of-concept in FreeBSD.
• Six vulnerabilities in dnsmasq (including CVE-2026-4890, CVE-2026-4891, CVE-2026-4892 and CVE-2026-5172).
• A denial-of-service technique dubbed the HTTP/2 Bomb that affects major HTTP/2 implementations such as NGINX, Apache, IIS and Pingora.
• Five exploitable issues in Google Chrome’s V8 JavaScript engine.
• Ten exploitable vulnerabilities in Apple Safari.
• A WebAssembly flaw in Mozilla Firefox (CVE-2026-8390).

OpenAI described Patch the Planet as creating a complete defensive loop for maintainers – from discovery and validation through severity review, disclosure, patch development, testing and deployment. While frontier models can speed parts of this cycle, the stated goal is to give those responsible for shared infrastructure stronger tools and greater capacity without removing their control over how changes are rolled out.

Industry and government actors have repeatedly cautioned that advanced AI models can compress the interval between vulnerability discovery and exploitation, narrowing defenders’ response windows. The emergence of so-called vibe-coded exploits is being pointed to as another signal that AI is not only lowering technical barriers to crafting exploits but also enabling attackers to more efficiently probe large numbers of newly public vulnerabilities. Intelligence agencies from Australia, Canada, New Zealand, the U.K. and the U.S. have warned that advanced AI could magnify the speed, scale and sophistication of cyber threats while making it easier for less-skilled actors to launch attacks. They added that frontier AI is expected to surpass current expectations and reshape both offensive and defensive cyber capabilities on a timeline measured in months rather than years.

The agencies emphasized that resilience will depend on getting fundamentals right, moving quickly and embedding cybersecurity into core business strategy; organizations that fail to do so risk mounting operational and strategic disadvantages.