OpenAI is in early talks to buy Trail of Bits, the New York-based security firm that finds and fixes vulnerabilities in open-source software, according to The Information1. The deal, if completed, would deepen OpenAI's push to build a substantial cybersecurity business.
Neither company has publicly confirmed the discussions2. Trail of Bits was founded in 2012 and has more than 40 employees.
The acquisition talks follow a working relationship that is already producing results. In June 2026, OpenAI and Trail of Bits launched an initiative called Patch the Planet, aimed at hardening open-source software. The effort pairs OpenAI's AI models, specifically GPT-5.5-Cyber and Codex Security, with Trail of Bits' human security experts to identify and remediate flaws in widely used code.
In its first week, Trail of Bits deployed roughly 25 engineers on the project. That team identified hundreds of vulnerabilities and merged dozens of patches across more than 30 open-source projects, including cURL, Python, and Go.
ANALYSIS Acquiring Trail of Bits would convert a collaboration partner into an in-house capability, giving OpenAI both the human expertise and the operational track record needed to sell cybersecurity services rather than just models.