Daybreak announced Patch the Planet, an initiative developed with Trail of Bits to help maintainers improve the security of critical open-source software. The program combines AI-assisted vulnerability discovery using Daybreak’s most cyber-capable models with expert human review; the goal is not only to find vulnerabilities but to help produce and integrate fixes.
Why the initiative exists
AI is speeding up vulnerability discovery, but discovery alone does not protect users. Many maintainers already face more reports and faster timelines with limited resources. Patch the Planet is designed to reduce that burden: security engineers vet findings before they reach maintainers, collaborate on patches and tests, and build reusable workflows so projects can continue to improve security after initial fixes land.
Partners and roles
Trail of Bits committed their entire security research organization for the initial surge. Trail of Bits engineers work directly with maintainers to investigate and validate vulnerabilities, develop and test patches, and coordinate responsible disclosure through project channels. Daybreak is also partnering with HackerOne and Calif to support triage, coordinated disclosure, and additional targeted discovery efforts.
How engagements proceed
Each Patch the Planet engagement begins with consultation with the maintainer. Security engineers work with maintainers to understand project needs and preferences — for example, vulnerability validation, patch development, CI/CD improvements, or longer-term security engineering — and then researchers investigate potential issues, validate meaningful findings, develop or refine patches, support testing, and coordinate disclosure.
Initial participants and impact areas
Initial participants include: cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python, and python.org. These projects cover widely used networking, cryptography, software supply chain, and language infrastructure where stronger security benefits a broad set of downstream products and services. Additional projects will join in later rounds.
Tools and access provided
Security researchers are equipped with frontier models and Codex Security to support analysis, patch development, testing, and documentation. Participating projects receive access to ChatGPT Pro; conditional access to Codex Security; and API credits for open-source development, maintainer automation, and release workflows. Trail of Bits developed AI-assisted workflows for deduplication, triage, and patching that projects can run with this support.
Results from the initial surge
Trail of Bits dedicated security engineers worked full-time with Codex and GPT‑5.5‑Cyber across 19 open-source projects. The team has already identified hundreds of security issues and merged dozens of patches, with many more cases currently under coordinated disclosure. The announcement notes that precise counts and some project-specific details will be shared later as disclosure progresses.
The sprint also produced reusable security infrastructure: fuzzing harnesses, historical-CVE analysis pipelines, differential-testing systems, threat models, expanded test suites, and workflows for deduplication, false-positive filtering, severity correction, and patch generation. Some project-specific outputs will be disclosed later once testing and remediation are complete.
Early technical examples
-
Fuzzing lab in less than a day: Trail of Bits engineers used repeated Codex/goal runs together with GPT‑5.5‑Cyber to assemble a fuzzing lab covering dozens of entry points, variant builds, platforms, and novel test seeds. The system used coverage feedback to expand into new surfaces, target edge cases, and filter weak candidates; the setup took under a day versus the weeks manual construction would typically require.
-
Reusable pipeline for variants of known vulnerabilities: the team built an end-to-end system that ingests historical CVEs, extracts vulnerability patterns, searches target codebases for related flaws, and sends candidates through specialized judging agents. The pipeline deduplicates results, filters likely false positives, and routes the strongest evidence to security engineers for manual confirmation.
-
Differential testing in days: Codex generated and iterated shim and glue code to connect multiple implementations to a common test harness, allowing implementations of the same protocol to be fuzzed against one another and behavioral differences investigated. The workflow filtered weak or invalid results and produced a high-signal set of candidates for expert review, compressing work that historically required weeks or months into days.
-
Tests grounded in specifications: teams used Codex to develop threat models, attack taxonomies, invariant tests, and property-based tests tied to project specifications and RFCs. These methods revealed notable mismatches between intended and actual behavior while leaving projects with broader coverage, better documentation, and CI/CD and supply-chain tooling improvements.
Human review remains central
Trail of Bits engineers manually reviewed every finding before submission to a maintainer. This step is critical because frontier AI models, while capable, also produce many false positives that would otherwise add to maintainers’ backlog. Trail of Bits reproduces evidence, checks findings against project-specific documentation and threat models, removes duplicates, reassesses severity, and prioritizes confirmed vulnerabilities for remediation. They also develop and submit patches according to maintainer preferences. Maintainers remain in control of which patches are deployed and how disclosure is handled.
Looking ahead
Patch the Planet builds on Daybreak’s broader work demonstrating how frontier models can assist defenders in finding, validating, and remediating serious vulnerabilities in widely used software. The announcement shares early highlights but withholds exploit mechanics and project-specific details while disclosure is underway. As fixes land and coordinated disclosures conclude, Daybreak and partners plan to publish deeper technical reports describing individual findings, research methods, validation workflows, and lessons for other defenders.
The initiative treats open-source software as shared infrastructure that requires shared responsibility. By putting the full defensive loop — discovery, validation, severity review, disclosure, patch development, testing, and deployment — at maintainers’ service, Patch the Planet aims to give those responsible for shared infrastructure better tools and capacity while preserving their agency over how changes land. The first sprint demonstrates immediate fixes, stronger project infrastructure, and reusable security work that can continue to improve open-source software over time. Maintainers can apply to join Patch the Planet as the program continues to expand.
