OpenAI in early talks to buy Trail of Bits, report says

OpenAI is in early talks to buy Trail of Bits, a New York-based software security firm, The Information reported Tuesday, citing people familiar with the matter. The deal would expand the ChatGPT maker's growing cybersecurity business. The size of a possible deal was not disclosed.theinformation+1

Neither company has publicly confirmed the talks. Because the discussions are described as early, no deal is certain.cryptobriefing

A partnership that came first

The two companies already work together. On June 22, they launched Patch the Planet, an open-source security project that is part of OpenAI's wider Daybreak cybersecurity effort. In its announcement, OpenAI said the project pairs "AI-assisted security research using our most cyber-capable models with expert human review to not only identify vulnerabilities, but help patch them."openai+1

According to OpenAI, Trail of Bits committed its "entire security research organization" to the project's first push. Its engineers check findings, write and test patches, and coordinate disclosure with the people who maintain each project. The first participants included cURL, the Go project, Python, Sigstore and pyca/cryptography.openai

Trail of Bits wrote on its blog that the first week alone turned up hundreds of bugs, along with 64 pull requests and 51 issues filed across 19 projects. By July 20, the firm's public dashboard showed 858 potential bugs reported, 143 patches merged upstream and 41 codebases under review. The firm has also published field reports on its work with OpenAI's tools. In one, it said GPT-5.5-Cyber built a custom fuzzing campaign for the zlib compression library in a single day, work that once took skilled researchers weeks.trailofbits+2

Building a security business

Trail of Bits specializes in finding and fixing flaws in open-source software. It has also done security audits for crypto projects including Uniswap, Aave and Worldcoin. Buying the firm would bring a team of experienced human security researchers into OpenAI. These are the experts who currently check and fix the problems its AI models flag.techflowpost+1

The Information described the move as part of OpenAI's effort to build a sizable cybersecurity business. AI models are now finding software flaws faster than the volunteers who maintain open-source projects can fix them. OpenAI has framed that gap as the problem Patch the Planet was built to solve. It says the project has security engineers screen findings before they reach maintainers, so that it reduces their burden "not add to it".panews+1