64 pull requests, 19 projects, and the maintainer problem
In its first week, OpenAI's Patch the Planet produced 64 pull requests across 19 open-source projects, but the harder problem is getting patches through the full path: accepted by maintainers, tested, released, and installed by users.
OpenAI's Patch the Planet, a program with Trail of Bits (cybersecurity), HackerOne (bug bounty), researchers, and open-source maintainers, produced 64 pull requests and 51 issues across 19 projects in its first week, including cURL, Go, Python, Sigstore, and pyca/cryptography.
Since March, Codex Security, OpenAI's automated vulnerability scanning tool, has scanned more than 30 million commits across more than 30,000 codebases. People marked more than 70,000 findings as fixed; the system identified more than 500,000 more as fixed automatically. But finding a vulnerability is half the problem.
Linux Foundation and Harvard research puts the bottleneck in numbers: in 94% of widely used open-source projects, fewer than ten developers write more than 90% of the code in a year. An auto-generated pull request solves nothing by itself. A maintainer has to accept it, the tests have to pass, a release has to ship, and users have to update.
GPT-5.5-Cyber scored 85.6% on CyberGym (a benchmark for reproducing known vulnerabilities in software environments) versus 81.8% for standard GPT-5.5. On ExploitGym, where the task is turning a known flaw into a working attack path, the gap widens: 39.5% versus 25.95%. Models are approaching the dangerous boundary faster, and OpenAI limits GPT-5.5-Cyber to vetted organizations, with monitoring, restrictions, and human review.
Researchers filter model output before it reaches maintainers. Some of the work: tests, pre-merge checks, fixes in a big-integer library, Python supply-chain improvements. The real test: can a fix complete the path from a discovered bug to an update that actually reaches users.
Patch the Planet directly targets the libraries (cURL, Go, Python, pyca/cryptography) that health-tech startups in MATTER's network depend on as core infrastructure. The news provides concrete first-week metrics that support a specific claim about supply-chain risk for health-tech ecosystems, linking to MATTER's Eternal Search profile as a hub whose portfolio companies inherit every unpatched open-source dependency in those libraries.