OpenAI launches Patch the Planet and full GPT-5.5-Cyber, shifting to patching

OpenAI launched 'Patch the Planet,' an initiative to fix bugs in open-source software at scale, alongside the full release of GPT-5.5-Cyber, its most capable model for authorized security work. Access is restricted to vetted firms, reflecting the dual-use risk of a model strong enough to both find and exploit vulnerabilities. President Greg Brockman said OpenAI's models are now 'discovering and generating patches for critical vulns in major browsers, network infrastructure, and operating systems' such as FreeBSD and the Linux kernel.

The key strategic shift is from discovery to remediation. Most AI-security hype has centered on finding vulnerabilities; OpenAI is explicitly reframing the goal as patching them — sustaining analysis across large codebases, assessing whether a vulnerability is actually reachable (to cut false positives), and carrying the work through to a usable fix. Sam Altman framed it as helping companies 'solve security problems instead of just finding them,' positioning OpenAI's Daybreak/Codex Security effort as defensive infrastructure.

This is a direct competitive shot at Anthropic, whose Mythos-class security work has anchored its frontier-safety narrative, and it dovetails with AWS's Continuum and GuardDuty AI investigations — three major labs converging on agentic, remediation-focused security in the same fortnight. The CyberGym benchmark, which Altman cited for state-of-the-art performance, is becoming a competitive yardstick.

The debate it reignited is dual-use risk: a 'more permissive' model for authorized security work is also, by construction, more capable of offense, and Five Eyes officials have warned that the offensive/defensive cyber balance could shift in months, not years. Gating access to vetted firms is OpenAI's mitigation, but the same week's news that OpenAI relaxed some controls keeps the proliferation worry alive among security practitioners.