OpenAI is in early talks to acquire Trail of Bits, the security research firm that finds and fixes weaknesses in open-source software, according to an October 13 report by The Information. The discussions are preliminary, and the report does not establish that an acquisition has been agreed or completed.
The attraction is more than a collection of bug-hunting tools. The companies already work together on AI-assisted security research, pairing models that identify potential weaknesses with engineers who check whether those weaknesses are real and help software maintainers repair them.
A cybersecurity business takes shape
The report, citing people familiar with the matter, says OpenAI is trying to build a substantial cybersecurity business. It does not identify the potential deal's size. No purchase price or closing date has been announced.
The existing partnership offers a concrete explanation for the interest. On June 22, OpenAI announced Patch the Planet, part of its Daybreak initiative, to support maintainers of critical open-source software. Initial participants included Python, Go, cURL and cryptography infrastructure used by other applications.
The company described the approach:
We’re pairing AI-assisted security research using our most cyber-capable models with expert human review to not only identify vulnerabilities, but help patch them.
That distinction matters. A model producing a convincing vulnerability report has not necessarily found an exploitable flaw. Engineers must reproduce the problem, assess its severity, remove duplicates and test a fix before handing it to the people responsible for the software.
The program also leaves deployment and disclosure decisions with maintainers. That puts human judgment between automated discovery and changes to software that other businesses depend on.
Another technique compares different implementations of the same protocol under identical inputs. Divergent results can expose a flaw. The teams also test whether software behaves as its specifications promise, then send promising findings for engineers to confirm and repair.
Faster discovery brings another risk
A July 2 account from Trail of Bits described GPT-5.5-Cyber building a fuzzing laboratory for zlib, a widely used compression library, in a day. Fuzzing tests software with varied inputs to expose errors. The firm's estimate that equivalent manual work would take weeks is its own assessment, rather than an independently established productivity benchmark.
The account also described why finding a crash is insufficient. An apparent problem might require conditions that do not occur in practical use. Rules about what counts as a valid, reportable finding are therefore essential to keeping automated research useful.
The same capability can help someone looking for weaknesses to exploit. Researcher Benjamin Samuels wrote:
Every new capability that helps us find bugs faster is just as available to an attacker, so the advantage goes to whoever finds the bugs and fixes them first.
That is the central tension behind using AI as a cybersecurity weapon: speed can strengthen defenders while also reducing the work required to probe vulnerable software.
The human work still matters
OpenAI has also described its models assisting with an internal security investigation. As previously reported by Apex, the company said an employee allegedly used a concealed recording device and that its own models helped investigate the incident. That allegation remains separate from the acquisition talks.
For software maintainers, the practical question is whether AI delivers tested repairs or simply a larger queue of reports. The existing collaboration addresses that by combining discovery with verification, patch development and coordinated disclosure.
Bringing those engineers inside OpenAI could put vulnerability research, model development and practical remediation under one roof. Whether ownership replaces their existing partnership remains unsettled: the reported acquisition negotiations are still preliminary, and no agreed transaction has been publicly confirmed yet.