OpenAI in early talks to acquire Trail of Bits, The Information reports: what's known about the deal and Patch the Planet

Update, October 22, 2026: On October 21, 2026, OpenAI proposed a five-stage disclosure framework for AI-found vulnerabilities under the name Patch the Planet. See our analysis.

OpenAI is in early talks to acquire Trail of Bits, a security firm that finds and fixes vulnerabilities in open-source software, The Information reported on October 13, 2026, citing people familiar with the matter. The two companies already work together on Patch the Planet, an initiative launched in June that pairs OpenAI's models with Trail of Bits engineers to get security fixes merged into widely used projects.

This story is based on The Information's report as summarized in its published description and by other outlets, plus OpenAI's and Trail of Bits' own posts about Patch the Planet, checked October 14, 2026. The deal is reported, not confirmed.

The short version

• The report: OpenAI is in "early talks to buy Trail of Bits," according to The Information. Deal size is unknown.
• Status: unconfirmed. Neither company had commented publicly as of October 14, and talks may not lead to a deal.
• Existing tie: Patch the Planet, launched June 22, 2026, as part of OpenAI's Daybreak cybersecurity program.
• Why it matters: OpenAI is building a security business as AI tools drive record bug counts, and Anthropic is chasing the same market.

What did The Information report?

The Information's article, headlined "OpenAI Eyes Acquisition That Could Boost Cybersecurity Business," is paywalled. Its published description says OpenAI, "which is trying to develop a substantial cybersecurity business, is in early talks to buy Trail of Bits." It adds that "the size of the potential deal couldn't be learned." The market news service Newsquawk flagged the report at 22:31 UTC on October 13.

Sweden's Börsvärlden, summarizing the same report on October 14, said the discussions are ongoing and may not result in a deal. South Korea's DigitalToday, also citing The Information, added that OpenAI and Anthropic have competed this year to build AI for finding software vulnerabilities.

No second outlet has independently confirmed the talks. 9to5AI found no statement from either company.

Who is Trail of Bits?

Trail of Bits is a security research and auditing firm that has operated "since 2012," according to its website. It works on software assurance, cryptography, blockchain and AI system security, and publishes a long list of audits and open-source tools. Its CEO, Dan Guido, has given a 2026 talk titled "How we made Trail of Bits AI-Native (so far)," about rebuilding the firm's work around AI tools.

What is Patch the Planet?

OpenAI and Trail of Bits announced Patch the Planet on June 22, 2026. OpenAI's Daybreak announcement describes it as an effort "to help open-source maintainers move from findings to fixes," founded with Trail of Bits in collaboration with HackerOne and Calif.

According to OpenAI, participating projects receive:

• ChatGPT Pro
• conditional access to Codex Security, OpenAI's vulnerability scanning and patching tool
• API credits for development, maintainer automation and release work

Trail of Bits' launch post says its engineers used GPT-5.5-Cyber and Codex to find bugs, then triaged them and worked on fixes with maintainers. In the first week it covered 19 projects, including cURL, the Go project, Python, Sigstore, pyca, urllib3 and PyPI. Trail of Bits reported "hundreds" of bugs found, 64 pull requests and 51 issues filed publicly, and 37 patches merged, and said the public tally undercounts work handled privately. More than 30 projects have joined. These figures come from the two companies and haven't been independently checked.

Trail of Bits has since published field reports. On July 2 it wrote that GPT-5.5-Cyber built a zlib fuzzing lab in a day, and on July 28 it described using Codex's /goal feature to find bugs. Our Codex explainer covers how Codex works.

Why would OpenAI want a security firm?

The Information frames it as part of OpenAI's push to build "a substantial cybersecurity business." OpenAI's Daybreak program already includes Codex Security and GPT-5.5-Cyber, a model with fewer restrictions for vetted defenders. Owning Trail of Bits would bring in-house the human reviewers who turn AI findings into fixes that maintainers accept.

That human layer is the bottleneck. Microsoft's record October Patch Tuesday fixed more than 1,400 CVEs, and Microsoft has said AI-assisted discovery is driving larger releases. Anthropic launched free OSS Scanner reports for open-source maintainers on October 8 as part of its Cyber Mission, after, Anthropic says, finding more than 29,000 candidate vulnerabilities in six months but manually triaging only about 6,000. For OpenAI's wider business, see OpenAI explained.

What's confirmed, reported and uncertain

• Confirmed (OpenAI and Trail of Bits): Patch the Planet's launch date, partners, what participants receive, and the first-week figures as the companies state them.
• Reported (The Information, October 13): early acquisition talks; deal size unknown.
• Uncertain: whether a deal happens, its price and structure, what happens to Trail of Bits' work for other clients, and whether Patch the Planet would change.