OpenAI is in early-stage acquisition talks with the security firm Trail of Bits. Previously, the two parties collaborated using Codex to fix vulnerabilities in open-source software, reducing tasks that once took weeks to just one day. Now, the human verification of issues identified by the model, patch delivery, and collaboration with maintainers could also become additional areas for OpenAI to strengthen.
According to the latest report from The Information, OpenAI is in early-stage negotiations to acquire the security firm Trail of Bits in an effort to expand its cybersecurity operations. Sources familiar with the matter say discussions are ongoing and the deal could still fall through; the publication has not learned the potential transaction value.
The target of the acquisition has contributed to patching open-source software.
Trail of Bits, founded in 2012, offers services including security research, tool development, and open-source project maintenance. According to its website, as cited by The Information, the company has more than 40 employees, most of whom are security engineers.
The two parties established a partnership in June this year. The report states that Trail of Bits personnel, as part of the Patch the Planet project, used Codex and specialized models for cybersecurity to identify, review, and fix vulnerabilities in open-source projects such as Python.
Dan Guido, CEO of Trail of Bits, previously stated in the project's promotional video that the team has built over a decade of collaboration with the open-source community. He said that Codex has reduced tasks that once took weeks to just one day.
The engineer verifies first, then passes it on to the maintainer.
In the collaboration plan announced by OpenAI in June, human security review was listed as a foundational element. Researchers first coordinate with open-source maintainers to establish priorities and disclosure processes, then verify, de-duplicate, and patch vulnerabilities before submitting them to the maintainers.
According to OpenAI’s disclosed plan at the time, the company provided funding, Codex Security, and model support to experts, with HackerOne and Calif also participating in the collaboration. More than 30 open-source projects have committed to join, with the first including cURL, Go, and Python.
OpenAI states that which changes are adopted is still determined by humans. OpenAI says that the initial five days of focused work generated hundreds of issues for review and dozens of patches were successfully merged.
The Rust case retains a manual review step.
In July, Trail of Bits published an engineering practice that demonstrated a concrete delivery process. Engineers built a vulnerability variant analysis system for the Rust compiler, first filtering existing issues and then deploying different agents to independently identify security flaws sharing the same root cause.
Candidate results must undergo two rounds of verification: first, assess whether there is a genuine security risk; second, have another model determine whether the issue could cause a security impact under Rust’s threat model. Only after passing both rounds are the results subject to manual review and repeated verification before being submitted to the upstream project.
The company also documented the tool’s limitations: during the review of zlib, Codex repeatedly stalled on the same code segments; when tasked with finding vulnerabilities and improving coverage, it tended to favor coverage. The team subsequently split different code areas into separate tasks while retaining one open-ended exploration task.
As of the publication of the July article, Trail of Bits reported nine vulnerabilities identified through an adjusted variant search, three of which have been fixed and merged into the upstream code.