Trail of Bits already works with OpenAI to find and fix vulnerabilities in open-source projects. OpenAI is now reportedly discussing a purchase of the software-security firm, a deal that could bring more of the expertise needed to turn AI-generated bug reports into tested, accepted patches inside the model developer.
According to MT Newswires’ account of an October 13 report from The Information, the talks are preliminary. The report cited unnamed people familiar with the matter. The potential deal value could not be learned, and the discussions could fall apart.
No definitive agreement, timetable or transaction terms were reported. MT Newswires said OpenAI did not immediately respond to its request for comment, and the available reporting includes no public confirmation of the talks from either company.
The acquisition remains a reported negotiation. Its potential strategic fit is easier to assess: OpenAI and Trail of Bits have already published evidence of working together.
An Existing Partnership Makes the Potential Fit Concrete
Trail of Bits announced Patch the Planet on June 22, describing an open-source security initiative conducted in partnership with OpenAI and its Daybreak initiative. The program pairs security engineers with open-source maintainers and uses OpenAI models and tools to investigate bugs, develop fixes and improve testing.
In its account of the first week, Trail of Bits reported 64 pull requests and 51 issues across 19 projects, with 37 patches already merged. The projects included Python-related infrastructure, aiohttp, RustCrypto and other widely used software.
These are company-reported activity counts, not an independent performance benchmark or a tally of unique security vulnerabilities. The work also included correctness improvements, testing infrastructure and features maintainers had wanted to add. That broader scope makes the partnership more informative than a headline vulnerability count: its stated objective is to leave projects better maintained and better defended, beyond simply generating findings.
For example, Trail of Bits said its python.org work included adding continuous-integration security scanning and making changes to release infrastructure. It also described using Codex and GPT-5.5-Cyber for vulnerability research, testing historical bug variants and comparing the behavior of cryptographic libraries.
Although these remain the company’s descriptions of its own work, they establish that OpenAI would be acquiring a familiar partner. The collaboration already connects model capabilities with security engineering and open-source maintenance.
