OpenAI is in early, ongoing talks to buy Trail of Bits, a firm that finds and fixes security flaws in open-source software, Valida Pau and Amir Efrati reported for The Information on 13 October, citing people familiar with the matter. The deal could still fall apart, and its size is unknown. The Information reported that OpenAI has sometimes paid small startups low hundreds of millions of dollars in stock, and sometimes less. TNW said it had not independently verified the report and found no public comment from either company.

Trail of Bits was founded in 2012 and has more than 40 employees, according to The Information. Its engineers audit software for other organizations. In August, the firm began working with Cloudflare to audit Signal’s key verification. OpenAI and Trail of Bits have worked together since June, when OpenAI said the firm had committed its entire security research organization to a joint project fixing open-source software.

The companies launched Patch the Planet within OpenAI’s Daybreak cyber programme. Trail of Bits engineers use OpenAI’s GPT-5.5-Cyber model and Codex tools to find bugs in open-source projects, check the findings, write patches and work with maintainers on fixes. At launch, the team was working full time across 19 projects, including cURL, Python and Go, OpenAI said. By then, it had found hundreds of security issues and merged dozens of patches.

The Information reported that OpenAI is trying to build a substantial cybersecurity business. In September, OpenAI put $1bn behind cyber defence for water utilities and community banks under Daybreak. Also in September, it bought camera startup Glass Imaging.

OpenAI is in early, ongoing talks to buy Trail of Bits, a firm that finds and fixes security flaws in open-source software, Valida Pau and Amir Efrati reported for The Information on 13 October, citing people familiar with the matter. The deal could still fall apart, and its size is unknown. The Information reported that OpenAI has sometimes paid small startups low hundreds of millions of dollars in stock, and sometimes less. TNW said it had not independently verified the report and found no public comment from either company.

Trail of Bits was founded in 2012 and has more than 40 employees, according to The Information. Its engineers audit software for other organizations. In August, the firm began working with Cloudflare to audit Signal’s key verification. OpenAI and Trail of Bits have worked together since June, when OpenAI said the firm had committed its entire security research organization to a joint project fixing open-source software.

The companies launched Patch the Planet within OpenAI’s Daybreak cyber programme. Trail of Bits engineers use OpenAI’s GPT-5.5-Cyber model and Codex tools to find bugs in open-source projects, check the findings, write patches and work with maintainers on fixes. At launch, the team was working full time across 19 projects, including cURL, Python and Go, OpenAI said. By then, it had found hundreds of security issues and merged dozens of patches.

The Information reported that OpenAI is trying to build a substantial cybersecurity business. In September, OpenAI put $1bn behind cyber defence for water utilities and community banks under Daybreak. Also in September, it bought camera startup Glass Imaging.