OpenAI announced a flurry of cybersecurity-related AI news on Monday, releasing an improved version of GPT\u20115.5\u2011Cyber, its most advanced vulnerability-finding model, along with an expanded partner program for cybersecurity vendors, an update to its Codex Security scanner\u2060, and an initiative to \u201cPatch the Planet\u201d \u2013 or at least 30 high-profile open source projects.<\/p>\n
The announcements come as Anthropic\u2019s Mythos mess keeps getting more complicated<\/a>, with national security concerns<\/a> clouding defenders\u2019 abilities to use<\/a> that AI company\u2019s most advanced models<\/a> to find and fix vulnerabilities \u2013 or perhaps it\u2019s just politics as usual.<\/p>\n They also coincide with a general feeling of FUD around AI cyberattacks<\/a> and the impending vulnpocalype<\/a>. The Reg\u2019s vultures will keep out collective eyes on all of this.<\/p>\n First off: GPT\u20115.5\u2011Cyber. After releasing a preview version of the model to a select group of \u201ctrusted defenders,\u201d<\/a> OpenAI on Monday released an update that it says makes the model even better at finding \u2013 and also fixing \u2013 bugs in code.<\/p>\n \u201cIt is our strongest model yet for finding and helping patch software vulnerabilities, while retaining GPT\u20115.5\u2019s general-purpose intelligence and ability to work across long, complex tasks,\u201d the AI shop said<\/a>. \u201cThe model can sustain deeper analysis across large codebases: identifying security-relevant components, tracing whether vulnerable code is reachable, validating likely issues in controlled environments, developing and testing patches, and preparing evidence for human review.\u201d<\/p>\n OpenAI said it evaluated the update and 5.5 preview using a few different benchmarks: CyberGym, which test how well AI systems can reproduce known vulnerabilities; ExploitGym, which determines how well models can turn known vulnerabilities into working exploits that achieve unauthorized code execution; and SEC-bench Pro, which measures AI systems\u2019 long-horizon vulnerability discovery and proof-of-concept generation capabilities.<\/p>\n The updated version 5.5 outperformed the preview model in all three tests, we\u2019re told.<\/p>\n On CyberGym, the updated GPT\u20115.5\u2011Cyber reached 85.6 percent success, compared with 81.8 percent for GPT\u20115.5. On ExploitGym, it outperformed the earlier model 39.5 percent versus 25.95 percent. And on SEC-bench Pro, GPT\u20115.5\u2011Cyber hit 69.8 percent, compared with 63.1 percent for GPT\u20115.5.<\/p>\n Plus, OpenAI assures everyone that it\u2019s had \u201congoing dialogue\u201d with the US government, including about its latest model plus upcoming releases, so hopefully that insulates the company against any surprise export controls.<\/p>\n OpenAI also expanded its partner program. The OpenAI Daybreak Cyber Partner Program<\/a> currently has about 30 security-vendor and service-provider partners, and only these select firms get to use the updated GPT\u20115.5\u2011Cyber model. OpenAI says it plans to add more organizations to the elite group \u201cin the coming months.\u201d<\/p>\n FOSS flaw-finding<\/p>\n Also on Monday, OpenAI announced Patch the Planet<\/a>, an initiative to help open source project maintainers find and patch vulnerabilities. This initiative, co-founded with Trail of Bits and launched in collaboration with HackerOne and AI-powered bug hunting outfit Calif, provides participating open source projects with ChatGPT Pro, conditional access to its Codex Security scanner, and API credits for core development, maintainer automation, and release workflows.<\/p>\n \u201cMaintainers define their priorities, preferences, and established disclosure processes,\u201d according to OpenAI. \u201cPatch the Planet security researchers then manage the work end to end – validating and deduplicating both vulnerabilities and patches before they reach maintainers, significantly reducing the burden on maintainers and speeding up remediation.\u201d<\/p>\n Trail of Bits reports<\/a> that in the first week alone, Patch the Planet uncovered hundreds of bugs<\/a>, and generated 64 pull requests with 51 issues filed across 19 projects.<\/p>\n The 19 projects Patch the Planet assists includes cURL, NATS, pyca, Sigstore, aiohttp, the Go project, freenginx, Python and python.org, urllib3, PyPI, SimpleX, Valkey, and RustCrypto.<\/p>\n More than 30 projects have joined so far, and project maintainers can apply to join<\/a> the initiative.<\/p>\n Some of the initiative\u2019s highlights from the week include using GPT-5.5-Cyber to build a full-scale fuzzing lab in under a day \u2013 an effort we\u2019re told would have take human fuzzing experts two or three weeks to do manually.<\/p>\n Patch the Planet also used Codex to build a CVE variant analysis pipeline. This also took less than a day to complete.<\/p>\n