GPT-5-cyber Found 9 Vulns in 4 Days: Inside Trail of Bits' Pro Bono AI Audit Project Patch the Planet
JiaweiLiu_ · x · 2026-10-23
Trail of Bits details Patch the Planet, a pro bono initiative with OpenAI, Calif and HackerOne that uses AI to audit and secure open-source software for free — covering 68+ critical projects including PyPI, cURL, SQLite, WordPress and vLLM, which is why the PHP2Shell bug carried no bounty. Maintainers report that on codebases already audited by humans and other AI tools, GPT-5-cyber found 9 new vulnerabilities in just 4 days, with report quality (correct reproducers, clear explanations, accurate impact) exceeding every other report received that year. The workflow: Trail of Bits engineers scope the engagement first, frontier models scan, humans triage and co-produce patches so fixes reach users quickly. The thread was sparked by rez0's quip: "Hack a small company, make a little. Hack a big company, make a lot. Hack 70% of the world, make nothing."
More from AGI Musings
- Montreal.AI paper: rejection-only experience transfer cuts candidate checks from 233 to 118 — Ghost_Pilot_MD · 2026-10-23
- Anthropic co-founder Jack Clark: Chinese models are 'too dumb', 6-12 months behind on safety — pstAsiatech · 2026-10-23
- Skip the thesis: strong researchers should publish and share, not write for nobody — gabriberton · 2026-10-23
- Swapping Claude for Gemini mid-run at step 433: disk-based init-d state files make agent handoff seamless — RandalSchwartz · 2026-10-23
- Stripe's Link adds purchase protection as AI agent "fat-finger" insurance debate heats up — jeff_weinstein · 2026-10-23
- Security researcher defends Anthropic: Jason Clinton warned of AI hacking influx 2+ years ago — JeffLadish · 2026-10-23