OpenAI's AI found a 23 year old security flaw and made hacking teams withdraw
Written by AI · Translated by AI · Read the Swedish original
OpenAI's AI found a 23 year old bug in OpenBSD, and a Firefox finding made five of six teams leave a hacking competition. Nobody wanted to compete against the machine.
OpenAI launched Patch the Planet on 22 June, an initiative using AI models to find, review and fix security holes in open source software. The results so far are hard to dismiss.
GPT-5.5-Cyber found a 23 year old bug in the OpenBSD kernel, in a security focused operating system, that could give ordinary users full administrator access. OpenAI's researchers identified five exploitable vulnerabilities in Chrome's JavaScript engine. They found more than ten exploitable flaws in Safari in about a week.
In Firefox a WebAssembly vulnerability was found, a fault in the technology that lets browsers run fast code directly on the web. Mozilla patched it two days before Pwn2Own Berlin, an international hacking competition, which led five of six registered Firefox entries to withdraw.
The work is done with the security firm Trail of Bits, which reviews every finding by hand before passing it on to the people who maintain the projects. That is an important detail. AI does not only produce correct findings, it also produces large volumes of false positives. Without human review, maintainers risk drowning in reports.
That is also the most interesting consequence. AI can now find certain vulnerabilities at a rate that previously took considerably more manual expert work. But every finding still requires someone to verify it, judge its severity, write a patch, test it and coordinate a responsible disclosure.
The bottleneck has moved from finding problems to handling them.
The projects in the first round include cURL, Python, Go and freenginx. These are not niche projects, they are infrastructure that Swedish municipalities, banks, public authorities and SaaS companies use every day, often without thinking about it.
If AI starts hardening the security of that code, it will not show up as a new product. At best it shows up as fewer vulnerabilities that get exploited in time.
The question is whether the open source world can keep the pace. Maintainers of critical software often work with limited time and limited resources. Faster detection only helps if there is also the capacity to act on the findings.
Ask upplyst.ai
Why does it matter?
The bottleneck has moved from finding problems to handling them. Every finding still requires someone to verify it, judge its severity, write a patch and test it.
What is the background?
OpenAI launched Patch the Planet on 22 June, using AI models to find, review and fix security holes in open source software. GPT-5.5-Cyber found a 23 year old bug in the OpenBSD kernel, five exploitable vulnerabilities in Chrome's JavaScript engine and more than ten flaws in Safari in about a week. A Firefox finding was patched two days before the Pwn2Own Berlin hacking competition, which led five of six registered Firefox entries to withdraw. The first round covers cURL, Python, Go and freenginx among others.
What is uncertain?
AI also produces large volumes of false positives. The security firm Trail of Bits reviews every finding by hand before it goes further, and without that review maintainers risk drowning in reports.
What does it mean in Sweden?
The projects in the first round are not niche. This is infrastructure that Swedish municipalities, banks, public authorities and SaaS companies use every day without thinking about it, and the maintainers often work with limited time and limited resources.