Key Notes
- The Information reports early acquisition talks between OpenAI and Trail of Bits, while the potential price remains undisclosed.
- Trail of Bits has published audits for Uniswap, Aave and Worldcoin and already collaborates with OpenAI through Patch the Planet.
- The initiative combines AI-assisted research with expert validation and maintainer review, with bug reports and accepted patches tracked separately.
OpenAI is in early talks to buy Trail of Bits, The Information reported. The potential price is undisclosed.
The companies already work together through Patch the Planet, an open-source security initiative launched on June 22. Their collaboration pairs AI-assisted research with engineers who validate findings, develop fixes and work with the maintainers responsible for accepting changes.
For crypto developers, Trail of Bits is an established name in software audits. Its public record includes work on Uniswap, Aave and Worldcoin, alongside broader research into cryptography, applications and the software infrastructure used across digital services.
A security firm with a substantial crypto audit record
Trail of Bits’ report catalog documents engagements across smart contracts, blockchain systems and cryptographic implementations. These are specific assessments of particular products and versions, rather than a blanket assurance about every deployment using a project’s name.
Uniswap’s audit documentation identifies Trail of Bits’ review of the v3 core contracts in early 2021. That work included automated testing and symbolic execution, techniques for exploring program behavior and checking whether a contract can enter an unintended state.
Aave’s security page lists a Trail of Bits review dated February 10, 2026 among the assessments for Aave v4. The auditor’s own catalog also contains a Worldcoin application-security assessment from August 2023.
The record explains the firm’s relevance beyond a conventional cybersecurity acquisition story. Its work spans code that moves assets, implements cryptographic operations and connects blockchain applications to other systems. A software defect in those layers can create risk even when the underlying cryptographic algorithm remains sound.
Patch the Planet joins model output with engineering work
OpenAI’s original announcement places Patch the Planet within its Daybreak cybersecurity initiative. Initial participants included cURL, Python, the Go project, pyca/cryptography, Sigstore, aiohttp and other widely used open-source projects.
The program begins with a conversation about a maintainer’s priorities and existing security process. Researchers then investigate potential problems, reproduce meaningful findings, develop or refine patches, support testing and coordinate disclosure through the project’s established channels.
That workflow addresses a practical bottleneck in AI-assisted security. Generating a plausible bug report is easier than establishing its severity or producing a repair that fits a project’s design. Engineers must filter duplicates and false positives before maintainers spend time on the results.
OpenAI says researchers use its frontier models and Codex Security to assist analysis, patch development, tests and documentation. The initiative’s public description retains expert review and maintainer involvement throughout that process; model output alone does not determine what reaches a release.
The launch figures covered bugs, patches and broader improvements
Trail of Bits’ June 22 launch report described hundreds of discovered bugs, 64 pull requests and 51 filed issues across 19 projects during the first week. At that point, 37 patches had been merged and 19 issues had been closed with a fix.
Those categories should remain separate. A pull request is a proposed code change, while a merged patch has been accepted into a project. Bugs include correctness problems as well as security defects; the tally is not a count of hundreds of independently confirmed, exploitable vulnerabilities.
The same report said more than 30 projects had joined the initiative. That participation figure was broader than the 19 projects covered by the first-week output. It also said private reporting channels and coordinated disclosure meant the public totals did not capture every engagement.
Some contributions improved continuous-integration checks, release infrastructure, testing and supply-chain tooling. Trail of Bits highlighted work at python.org, RustCrypto, PyPI and SimpleX, illustrating that the program extends beyond identifying individual vulnerabilities.
Later results show why patch review still matters
In a September 15 follow-up analysis, Trail of Bits examined 186 Patch the Planet pull requests that maintainers had merged or closed by September 14. Maintainers merged 126 of them.
Of those merged submissions, 91 were accepted without an observed security-relevant revision, 33 involved such revisions and two had indeterminate outcomes. The firm cautioned that acceptance by a maintainer does not establish that every patch is correct.
Its review of subsequent changes also found functional, build, release and performance problems introduced by some patches, although it reported no exploitable security vulnerabilities in that review. These are the firm’s findings from a defined dataset, rather than a universal success rate for AI-generated repairs.
The work connects to a wider discussion about AI’s role in defending software. CoinScreamer previously covered Vitalik Buterin’s argument for stronger defensive tools, including AI-assisted formal verification.
It is also distinct from the possible mathematical breakthroughs discussed in our coverage of Buterin’s cryptography warning. Patch the Planet’s results concern specific software defects and repairs; they do not demonstrate that AI can recover wallet private keys from public keys.
The documented partnership offers a concrete view of what the companies already do together: combine faster vulnerability research with validation, repair and release work. The public program materials set out that collaboration, while leaving any future ownership arrangement and its effect on existing audit engagements unresolved.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
