Trail of Bits reports on Patch the Planet, a collaboration with OpenAI targeting open-source security. The headline finding: GPT-5.5-Cyber autonomously built a comprehensive fuzzing campaign for zlib in a single day — writing C/C++ harnesses across a dozen entrypoints, configuring ASan/UBSan builds, constructing seed corpora, and discovering multiple vulnerabilities currently under coordinated disclosure. The model independently decided static review was insufficient and pivoted to dynamic fuzzing without being instructed to. A key insight is that the model also demonstrated reporting discipline, filtering out unreachable crashes rather than flooding maintainers with noise. The broader takeaway is that the expertise barrier for bespoke fuzzing campaigns has effectively collapsed: what once took skilled researchers weeks now takes a day, lowering the floor for attackers while multiplying output for defenders. The post argues that proactive, AI-assisted fuzzing is now a necessary defensive posture for any security-critical project.
