OpenAI released Patch the Planet, an open-source security-AI project that packages Codex and GPT-5.5-Cyber into an end-to-end vulnerability-patching pipeline. The project aims to make security fixes as reproducible as CI/CD — a "vulnerability comes in, a patched PR goes out" pipeline.
The core workflow has four steps: discover (Crawler scans public CVE databases and OSS-Fuzz results) → triage (GPT-5.5-Cyber assesses exploitability) → patch (Codex generates the fix and writes a regression test) → review (a separate model verifies the patch and opens a PR). The whole pipeline is open-sourced, including the model weights (Codex-Sec-7B and GPT-5.5-Cyber-7B), the orchestration framework, and the patch templates.
The most notable thing is the "patch-as-code" philosophy: every patch is generated with a structured template (CVE description, exploit PoC, fix diff, regression test) and goes through a verification phase. The system also supports auto-filing a PR upstream, reducing the friction from "discovering a vulnerability" to "contributing a fix."
The bigger signal: OpenAI is taking the "defensive security AI" stance to the open-source front line — at a time when security research is increasingly closed off, Patch the Planet's open-source push is a clear counter-trend signal. For the industry, this means vulnerability patching is moving from a "manual expertise" game to an "AI automation" game, and open-source maintainers will likely become the biggest beneficiaries.