Modern AI models have prodigious coding capabilities—whether that poses a greater advantage for legitimate cyberdefenders or for malicious hackers is an open question. Either way, AI companies are thriving.
The cybersecurity sector has been in crisis mode in recent months as the spread of new and powerful AI systems, like Anthropic’s Mythos, has threatened to make much of the world’s existing cyberdefense infrastructure effectively obsolete. On Wednesday, the security company that built PHP, a technology powering as much as 70% of the world’s websites, issued an emergency patch for two major vulnerabilities that, if exploited, would allow hackers to take control of web servers. The vulnerabilities, known as PHP2Shell, were reportedly discovered using OpenAI’s GPT-5.6 Sol—an illustration of modern AI models’ aptitude for finding complex security flaws too subtle for humans to notice independently.
Not long after the initial reports of the release of the emergency patches on Wednesday morning, OpenAI announced in a blog post it was launching a framework aimed at fostering global cooperation to find and fix the many vulnerabilities that are likely still out there lurking in old software, waiting to be discovered either by cyber defenders or their black hat adversaries. With one hand, OpenAI is racing with other tech companies to develop the technology that’s actively revolutionizing cybercrime; with the other, it’s positioning itself as the front-line of defense against those same AI-equipped cybercriminals.
“Patch the Planet,” as OpenAI’s new initiative is being called, will aim “to help turn findings into protection and build a response that can scale as AI capabilities advance,” OpenAI wrote in its announcement. The company is inviting third-party cyber professionals to help “review the approach, challenge its assumptions, and identify gaps.” Basically a crowd-sourced mission, with some significant help from AI, to scour the internet for hidden security flaws before the bad guys find them first.
PHP2Shell is “one of the most impactful security issues in recent memory,” OpenAI said in its blog post. “It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.” The company also added that PHP security issues—while particularly dangerous given the scope of potential targets—were just two “among several significant vulnerabilities” it has already found, “and we expect similar findings to increase sharply in the coming months.”
In broad strokes, OpenAI’s proposal sketches out a blueprint for cybersecurity professionals to coordinate and find solutions with vulnerable organizations, government agencies, and other concerned parties after new security threats are discovered. It comes with its own website, where public disclosures and patch information can be conveniently posted. OpenAI said in its blog post it would devote $1 billion to subsidize access to Daybreak, its cybersecurity auditing platform, for “organizations with limited security resources protecting essential services.” It also launched a Codex skill on GitHub designed to check websites to see if they’ve been compromised by PHP2Shell.
Some of those essential services, including banks and much of the public sector, rely on software that runs on decades-old programming languages like COBOL and Fortran. In another blog post published Monday, OpenAI said its most recent models, including GPT-6 Astra and GPT-5.6 Sol, had demonstrated “substantial improvements” in their ability to translate codebases from one programming language to another. Here too, OpenAI is framing itself as a modernizing force, shepherding the world’s outdated digital systems into the AI-powered future—a future it’s determined to build.