“Trail of Bits has committed their entire security research organization,” OpenAI wrote in June, when the two companies launched a joint project to fix open-source software.
OpenAI is in early talks to buy Trail of Bits, a firm that finds and fixes security flaws in open-source software. Valida Pau and Amir Efrati reported the talks for The Information on 13 October, citing people familiar with the matter.
The talks are ongoing and could still fall apart, the people said. The size of a possible deal is not known. OpenAI has sometimes paid in the low hundreds of millions of dollars in stock for small startups, and sometimes less, The Information reported.
TNW has not independently verified the report. TNW found no public comment on the talks from either company.
A firm OpenAI already works with
Trail of Bits was founded in 2012 and has more than 40 employees, according to The Information. Its engineers audit software for others. In August, it began working with Cloudflare to audit Signal’s key verification.
The two companies have worked together since June. They launched Patch the Planet, a project inside OpenAI’s Daybreak cyber programme. Trail of Bits engineers use OpenAI’s GPT-5.5-Cyber model and its Codex tools to find bugs in open-source projects. They check the findings, write patches and work with the maintainers on fixes.
At launch, the team was working full time across 19 projects, OpenAI said. These include cURL, Python and the Go project. By then it had found hundreds of security issues and merged dozens of patches.
OpenAI’s push into security
OpenAI is trying to build a substantial cybersecurity business, The Information reported. In September, it put $1bn behind cyber defence for water utilities and community banks under Daybreak.
Also in September, OpenAI bought Glass Imaging, a camera startup.
Get the TNW newsletter
Get the most important tech news in your inbox each week.