OpenAI Built an AI That Writes the Exploit and the Patch

On June 22, OpenAI shipped a model that finds critical security holes in open-source software and writes the fixes for them. It’s called GPT-5.5-Cyber, the program is called Patch the Planet, and the part nobody at the launch wanted to dwell on is that the system writing the patch is the same one writing the exploit. In a demo, it generated 24 working privilege-escalation attacks against the Linux kernel. That’s the best defensive security tool ever built, or a weapon with an API key, depending entirely on who’s pointing it.

The benchmarks are real and the demo is scarier than the benchmarks. GPT-5.5-Cyber scored 85.6% on CyberGym, up from 81.8% for the standard GPT-5.5, according to SiliconANGLE’s account of the launch. In testing it produced 8 proof-of-concept pointer info-leaks and those 24 local privilege-escalation exploits after scanning more than 30 million lines of Linux kernel code. None of that is theoretical. A privilege-escalation exploit is the thing that turns a small foothold into full control of a machine, and the model wrote two dozen of them as a demonstration of how helpful it can be.

This is the problem with a tool that does both jobs. A model that can auto-generate 24 ways into the Linux kernel is defensive right up until someone turns it around, and there is no setting in the software that enforces good intentions. Patch the Planet is a great name for a program that, in the same motion, maps the planet’s soft spots in machine-readable detail. OpenAI knows this, which is why it is leaning so hard on human oversight. It’s the same dual-use line Anthropic was busy drawing with the Pentagon, and OpenAI just walked up to it from the other direction.

The safety story rests on manual review, and that is where it gets thin. OpenAI built Patch the Planet with Trail of Bits and HackerOne, and every finding gets hand-checked by experts before it reaches a maintainer, as the program’s official page lays out. That works at the pilot’s scale of 19 projects, a list that includes cURL, Go, Python, Sigstore, pyca/cryptography, and aiohttp. It does not obviously scale to the entire open-source world the marketing gestures at, where millions of repositories carry no security team at all. Human review is the bottleneck holding the safety pitch together, and a bottleneck is exactly what a model this fast is designed to remove. The discipline is real right now. The open question is whether it survives contact with ambition.

Security also carries an asymmetry the “arm both sides equally” pitch quietly skips. A defender has to find and patch every exploitable hole; an attacker needs one that nobody closed in time. Hand both the same model and you have not leveled the field, because the identical finding does very different work depending on who reads it. For a maintainer, 24 kernel exploits is a long weekend of triage. For someone who pulls the same capability through a jailbreak or an open-weights cousin of the model, it is 24 lottery tickets, and only one has to hit. Equal tools, wildly unequal stakes.

The counterargument is strong, and security people make it without flinching. Obscurity is already dead. Attackers are fuzzing open-source code with their own models today, so arming maintainers with the same firepower is the only way to keep pace, and a finding that passes human review before it ships beats the average bug bounty for rigor. Fair enough. But notice the timing. The same week OpenAI released an exploit-capable model, intelligence agencies in the Five Eyes alliance warned that AI-driven cyberattacks were “months away,” a pairing TechTimes drew explicitly. When the people who track nation-state hackers describe the threat they see coming, they are describing this exact capability, sold commercially, a year or two ahead of schedule.

There’s a bigger precedent buried in the launch. Until now, the most capable offensive security tooling lived inside intelligence agencies and a handful of specialist firms, gated by clearance and cost. OpenAI just put a version of it behind an API and a billing page. Even with the pilot’s guardrails bolted on, the capability itself is now a product with a roadmap, and products get cheaper, faster, and more available with every release. The Linux kernel findings are the demo. The trajectory is the story. A few years out, the question stops being whether an AI can write a privilege-escalation exploit and becomes whether anything at all slows down the version that isn’t wrapped in Trail of Bits and a press release.

And the people on the receiving end of all this are mostly volunteers. Huge swaths of the open-source code running the internet are maintained by a handful of unpaid people in their spare time, the cURL and OpenSSL maintainers of the world. Patch the Planet’s pitch quietly assumes those maintainers can absorb a firehose of AI-generated vulnerability reports, triage them, and ship fixes before anyone weaponizes the same findings. Some can. Most can’t, and they have said so for years about the ordinary bug reports they already drown in. Pointing a model this capable at their codebases hands them help and a deadline in the same package, and starts the clock whether they’re ready or not.

OpenAI’s bet is that defenders will always outrun attackers as long as you arm both sides equally. Maybe that holds. But the company just commercialized the most capable offensive security tool the public has ever had access to and asked everyone to trust that the patch always ships before the exploit leaks. The firewall didn’t die on June 22. It just got handed a model that knows every way through the wall it’s supposed to guard, with instructions to use that knowledge only for good. Tools have never once worked that way, and this one won’t be the first.

Sources: SiliconANGLE · OpenAI · TechTimes