The Repair Crew: OpenAI's Bet That AI Can Patch the Internet Faster Than It Breaks It
Amid fears that AI supercharges hackers, OpenAI is making the opposite wager — that its new cyber model and an open-source "Patch the Planet" effort can fix the world's software at machine speed.
TL;DR — The fear about AI and security is that it arms attackers. On June 22, 2026, OpenAI made the opposite bet — expanding its "Daybreak" program with a cyber-tuned model and an open-source "Patch the Planet" effort, arguing AI's real job is to fix bugs faster than anyone can exploit them.
Finding a vulnerability is the easy, glamorous part. Fixing it — across millions of unglamorous open-source projects — is the grind. OpenAI says that's exactly where AI should work.
A model, and a repair crew
Daybreak now includes GPT-5.5-Cyber, released to vetted defenders, and Patch the Planet, built with Trail of Bits and HackerOne to fund real fixes alongside the volunteers who maintain the world's code — with a human checking every machine-found flaw, per SiliconANGLE.
| Metric | GPT-5.5-Cyber | GPT-5.5 (standard) |
|---|---|---|
| CyberGym benchmark (reproduce known vulns) | 85.6% | 81.8% |
| Access | Vetted "trusted defenders" only | General |
| Purpose | Find, validate & patch vulnerabilities | General-purpose |
Proof it bites
The tooling has already surfaced a 23-year-old flaw in the OpenBSD kernel and five exploitable bugs in Chrome's V8 engine, and OpenAI says it has combed 30 million commits across 30,000 codebases, per Infosecurity Magazine. The partner roster — from CrowdStrike and Palo Alto to the governments of Japan and South Korea — signals this is meant as infrastructure, not a demo. "We can help security teams improve threat investigation, decision-making, and efficiency," said Proofpoint strategy chief Ryan Kalember.
FAQ
What did OpenAI announce?
An expansion of its Daybreak security program on June 22, 2026: a cyber model (GPT-5.5-Cyber), a code-security plugin, a partner program, and an open-source fixing effort, Patch the Planet.
Why focus on fixing, not finding?
OpenAI argues the bottleneck in security is remediation — actually patching the flood of known bugs — and that AI plus human review can speed that up.
Is the cyber model safe to release?
It's limited to vetted "trusted defenders" with extra monitoring, scoring 85.6% on the CyberGym benchmark.
What has it found?
Reported finds include a 23-year-old OpenBSD kernel bug and five exploitable Chrome V8 vulnerabilities.
Sources: SiliconANGLE, Infosecurity Magazine, IT Pro.
Image: mikemacmarketing, CC BY 2.0, via Wikimedia Commons.
← Back to all posts