OpenAI in Early Acquisition Talks with Trail of Bits
According to sources speaking to The Information, OpenAI is in early acquisition talks with New York security firm Trail of Bits to expand its cybersecurity business.
The size of the deal has not been disclosed, and neither party has publicly confirmed it. Trail of Bits, founded in 2012, has about 40 employees and focuses on discovering and fixing vulnerabilities in open-source software. It has provided security audits for crypto projects such as Uniswap, Aave, and Worldcoin.
The two parties launched the "Patch the Planet" open-source security initiative in June 2026, which is part of OpenAI's Daybreak cybersecurity project. This initiative pairs OpenAI's Codex and GPT-5.5-Cyber models with Trail of Bits engineers to discover and fix vulnerabilities in open-source software.
In the first week of the initiative, Trail of Bits deployed about 25 engineers, identifying hundreds of vulnerabilities and merging dozens of patches across more than 30 open-source projects, including cURL, Python, and Go (37 of which have been merged). Trail of Bits CEO Dan Guido stated that this effort aims to help open-source projects cope with the accelerated pace of vulnerability discovery driven by AI.
OpenAI is attempting to build a scalable cybersecurity business. In their collaboration, Trail of Bits has developed AI-assisted deduplication, triage, and patch workflows, providing ChatGPT Pro and Codex Security access to participating projects.
The buyer is OpenAI, seeking to integrate open-source security expertise into its own models and tool stack; the seller is Trail of Bits, focused on auditing and remediation. The flow of funds and talent is shifting from external collaboration to potential internal integration, benefiting the party that wishes to directly control human validation and patching capabilities after model output, while putting pressure on open-source and crypto projects that rely on independent third-party audits.
The news is still in its early stages, with no second source confirmation, and no formal announcement has been made.
Source: Public Information
ABAB AI Insight
OpenAI has been continuously expanding its model capabilities and commercialization paths since its inception, recently applying models to cybersecurity scenarios through projects like Daybreak. Trail of Bits, established in 2012, has long provided in-depth audits for open-source software and crypto protocols, with clients including Uniswap, Aave, and Worldcoin, and in Patch the Planet, around 25 engineers collaborated with OpenAI models to identify hundreds of vulnerabilities and merge dozens of patches in the first week.
In terms of capital strategy, OpenAI is shifting from external collaborations (providing model access and funding) to early acquisition talks, aiming to incorporate Trail of Bits' human expert validation and remediation processes into its cybersecurity business. The motivation is that while AI models can rapidly output vulnerability discoveries, validation, prioritization, and actual patching still rely on human experts; direct integration can shorten the cycle from discovery to merging and support the commercialization of security services to enterprise clients.
This is analogous to other AI companies acquiring small security or research teams to absorb domain-specific expertise, supplementing models in high-risk scenarios. Currently, OpenAI is in the phase of expanding model capabilities from general dialogue to executable security workflows, while Trail of Bits is transitioning from an independent auditing entity to a potential internal capability.
Essentially, this represents a combination of technological substitution and capital concentration: as AI accelerates vulnerability discovery, the value shifts from pure detection to a complete link of "discovery + validation + remediation," making human experts a scarce complementary resource. The mechanism is that when the model output speed exceeds the maintainers' processing capacity, the party with an expert team can achieve end-to-end control through integration, shifting pricing power from external services to internal productized security capabilities.
ABAB News · Cognitive Law
- Model accelerates discovery, experts still control remediation
- Shift to acquisition after four months of collaboration shows capability complementarity gap
- Open-source security shifts from external auditing to internal integration.