OpenAI in early talks to acquire cybersecurity firm Trail of Bits

OpenAI is currently in early talks to acquire Trail of Bits, a cybersecurity firm specializing in finding and fixing flaws in open-source software, according to a report by The Information on October 13. The acquisition discussions are ongoing and have not been confirmed by either company, with details provided by people familiar with the matter.

The potential deal size remains unknown, though The Information noted that OpenAI has previously paid in the low hundreds of millions of dollars in stock for smaller startups. The negotiations could still fall apart, as no final agreement has been reached. Trail of Bits was founded in 2012 and currently employs more than 40 people who audit software for various clients.

Context and Background

The two companies began a formal partnership in June when they launched Patch the Planet, a project under OpenAI’s Daybreak cyber program. Trail of Bits committed its entire security research organization to this initiative. Engineers from Trail of Bits use OpenAI’s GPT-5.5-Cyber model and Codex tools to identify bugs in open-source projects.

At the launch of the project, the team was working full time across 19 specific open-source projects. These projects include cURL, Python, and the Go project. By the time of the launch, the collaboration had already found hundreds of security issues and merged dozens of patches into the respective codebases.

Who Is Affected

Trail of Bits continues to work with other clients independently of its partnership with OpenAI. In August, the firm began working with Cloudflare to audit Signal’s key verification processes. This demonstrates that Trail of Bits maintains separate commercial relationships while collaborating with OpenAI on broader open-source security improvements.

OpenAI is actively trying to build a substantial cybersecurity business beyond its core AI products. In September, the company put $1 billion behind cyber defense for water utilities and community banks under the Daybreak program. Also in September, OpenAI acquired Glass Imaging, a camera startup, signaling a broader expansion strategy.

What should you do?

Security professionals should monitor official announcements from both OpenAI and Trail of Bits for confirmation of the acquisition. The ongoing talks may impact how Trail of Bits conducts future audits or manages its existing client relationships. Users of open-source software should continue to apply patches as they are released by maintainers, regardless of corporate ownership changes.

What to do and how to stay safe: OpenAI

• Monitor official channels from OpenAI and Trail of Bits for confirmation of any acquisition deal.
• Continue to apply security patches to open-source software as they are released by maintainers.
• Review vendor contracts to understand how potential corporate acquisitions might affect service levels.
• Verify the source of security updates to ensure they come from trusted maintainers.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is the acquisition of Trail of Bits by OpenAI confirmed?

No, the acquisition is not confirmed. The Information reports that the two companies are in early talks, which could still fall apart.

What is Patch the Planet?

Patch the Planet is a joint project launched in June under OpenAI’s Daybreak program, where Trail of Bits engineers use AI tools to find and fix bugs in open-source software.

How much is OpenAI paying for Trail of Bits?

The size of the possible deal is not known. The Information reported that OpenAI has sometimes paid in the low hundreds of millions of dollars for small startups.