OpenAI Patch the Planet: Linux/BSD/Chrome/Safari/Firefox Vulnerabilities & PoCs

Vulnerability Overview OpenAI has launched the "Patch the Planet" initiative, aimed at supporting open-source software maintainers. This plan leverages AI-assisted security research combined with expert human review to not only identify vulnerabilities but also help patch them. While AI accelerates vulnerability discovery, discovery alone does not protect users. Many maintainers have already been burdened with handling an increasing volume of reports. "Patch the Planet" aims to alleviate this burden by assisting security engineers in reviewing findings, collaborating with projects to develop patches and tests, and building reusable workflows to help teams enhance security even after the initial fixes. Scope of Impact Operating Systems: - Linux Kernel: GPT-5.5-Cyber identified security-relevant components within over 30 million lines of code, flagged potential security issues, and dynamically validated these findings. It generated 8 kernel information leak proof-of-concepts (PoCs) and 24 local privilege escalation vulnerabilities. - OpenBSD: The model identified a System V semaphore vulnerability in an OpenBSD kernel implementation that had not been used for 23 years. OpenAI researchers reproduced the issue and confirmed that it allows unprivileged local users to escalate privileges to root. - FreeBSD: Security researchers used Codex to find and verify multiple local privilege escalation vulnerabilities in FreeBSD. OpenAI researchers confirmed 34 vulnerabilities and generated 7 local privilege escalation PoCs. Networking: - dnsmasq: Codex Security independently identified vulnerability patterns corresponding to four dnsmasq CVEs, which were subsequently fixed in version 2.92rel2: CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, and CVE-2026-5172. - HTTP/2 Bomb: Calif used Codex to identify an "HTTP/2 Bomb," a denial-of-service technique affecting multiple HTTP/2 implementations, including NGINX, Apache, IIS, and Pingora. Calif’s analysis indicates that over 880,000 internet-facing websites are running affected server software. Browsers: - Chrome: OpenAI researchers discovered and reported five exploitable vulnerabilities in Chrome’s V8 JavaScript engine, three of which were identified and fixed within days of their introduction. - Safari: After approximately one week of focused work on WebKit, over 10 exploitable Safari vulnerabilities were discovered. - Firefox: OpenAI Preparedness identified a WebAssembly vulnerability (CVE-2026-8390). During GPT-5.5’s security assessment, Mozilla patched the vulnerability two days before the Pwn2Own Berlin competition, resulting in the withdrawal of five registered Firefox entries. No successful demonstration of a Firefox exploit was achieved. Remediation Operating Systems: - Linux Kernel: OpenAI researchers dynamically validated potential security issues and generated PoCs. - OpenBSD: OpenAI researchers reproduced the issue and confirmed the vulnerability. - FreeBSD: OpenAI researchers confirmed the vulnerabilities and generated PoCs. Networking: - dnsmasq: Codex Security independently identified the vulnerability patterns, which were later addressed in version 2.92rel2. - HTTP/2 Bomb: Calif used Codex to identify the vulnerability, which affects multiple HTTP/2 implementations. Browsers: - Chrome: OpenAI researchers discovered and reported the vulnerabilities; three were identified and fixed within days of their introduction. - Safari: Over 10 exploitable Safari vulnerabilities were discovered. - Firefox: OpenAI Preparedness identified a WebAssembly vulnerability, and Mozilla applied a patch two days before the Pwn2Own Berlin competition. POC Code or Exploit Code No specific POC code or exploit code is provided on this page.

Goal Reached Thanks to every supporter — we hit 100%!

OpenAI Patch the Planet: Linux/BSD/Chrome/Safari/Firefox Vulnerabilities & PoCs