OpenAI pushes AI security from finding bugs to fixing them

OpenAI published a major expansion of Daybreak on June 22, moving its AI security push from vulnerability discovery toward automated remediation. The company announced an updated Codex Security plugin, the full limited release of GPT-5.5-Cyber for trusted defenders, a cyber partner program and Patch the Planet, an open-source initiative founded with Trail of Bits and run in collaboration with HackerOne, Calif, researchers and maintainers.

The timing matters because AI is changing the economics of software security. OpenAI says its models can already search large codebases, trace attack paths, validate likely issues and generate patches. In the new announcement, the company says Codex Security has scanned more than 30,000 codebases and that human reviewers have marked more than 70,000 findings as fixed. GPT-5.5-Cyber is described as OpenAI's strongest model for authorized cybersecurity work, with higher benchmark scores than GPT-5.5 on CyberGym, ExploitGym and SEC-bench Pro.

Patch the Planet is the most practical part of the news. OpenAI says more than 30 open-source projects have committed to participate, including cURL, Go, Python, Sigstore and pyca/cryptography. The program gives maintainers expert security help, ChatGPT Pro, conditional access to Codex Security and API credits. Trail of Bits says its first week covered 19 projects and produced fuzzing labs, variant-analysis pipelines, differential testing and release-pipeline improvements. It also stresses that every serious finding needs human review before it reaches a maintainer.

That last point is important. AI can create a flood of bug reports, many of them noisy or incorrectly rated. Maintainers do not need more unverified alerts; they need triage, severity judgment, accepted patches, tests and coordinated disclosure. OpenAI is trying to position Daybreak as that full loop, not just another scanner.

For developers and companies, this is a sign that security tooling is becoming more agentic and more integrated into everyday software work. For open-source maintainers, it could bring real capacity to projects that underpin business, government and critical infrastructure. The risk is also clear: the same capabilities that help defenders move faster make governance, access controls and human oversight more important.