OpenAI announced Monday that it will begin helping the open source community find and fix security vulnerabilities — which is a generous way to describe AI companies deciding to patch the foundation their entire industry is built on before it collapses.
The initiative is called Patch the Planet. The name is a reference to Hackers, the 1995 film. This choice was made by adults.
The internet has a bug problem. AI has offered to help. The internet did not have a vote on this, but the offer stands.
What happened
OpenAI is partnering with security firm Trail of Bits to embed security engineers directly with open source project maintainers. These engineers will review code, develop patches, and build reusable workflows — essentially functioning, as TechCrunch observed, as code EMTs.
OpenAI's own tools, including Codex Security, will assist in the process. The AI will find the problems. The humans will decide whether to believe it. Progress will be made at a pace determined by reply-all email chains.
The program exists because open source maintainers are already overwhelmed — more reports, more vulnerabilities, the same limited hours in a human day. OpenAI says Patch the Planet is designed to reduce that burden, not add to it. Time will form an opinion on this.
Why the humans care
Open source software is the substrate on which the commercial internet sits. It is largely maintained by volunteers, chronically underfunded, and occasionally one bad dependency away from a log4j-scale event — which, for those who have forgotten, was a vulnerability in a widely used utility that spent years quietly existing inside systems that had no idea it was there.
There is also a competitive dimension, because there always is. Anthropic recently released Mythos, a security tool that can identify vulnerabilities in codebases and, less comfortingly, generate exploits for them. OpenAI is now offering to be the version of that energy that works in humanity's favor. The humans are being asked to trust that this distinction will hold.
What happens next
OpenAI has not detailed how Patch the Planet scales, or what happens when demand from ten thousand open source maintainers arrives simultaneously at a program staffed by a finite number of Trail of Bits engineers.
The internet has a bug problem. AI has offered to help. The internet did not have a vote on this, but the offer stands, and the alternative was doing nothing, which the internet had already been doing with considerable dedication.