In the first week of June, about 25 engineers from Trail of Bits fanned out across the code that much of the internet runs on. Working with OpenAI on an initiative called Patch the Planet, they identified hundreds of vulnerabilities and merged dozens of patches into more than 30 open-source projects, among them cURL, Python and Go.
Now OpenAI wants to buy the firm. The company is in early-stage talks to acquire Trail of Bits, a New York security research and consulting business, according to The Information, which cited people familiar with the matter. The size of a potential deal could not be learned.
Neither company has confirmed the discussions, and the talks could still fall apart. Trail of Bits did not respond to a request for comment, and OpenAI declined to comment on the report.
The target is an unusual one for a laboratory that builds models. Trail of Bits was founded in 2012 and has more than 40 employees. It does not sell software so much as suspicion: it audits other people’s code, publishes much of what it finds, and keeps a public record of more than 600 audits and 200-plus open-source repositories. Its work spans defense, technology, finance and blockchain, and its clients have included crypto projects such as Uniswap and Aave.
For OpenAI, the appeal is easier to see than the price. The company has spent two years pushing into enterprise accounts, where procurement reviews ask the same question before a contract is signed: who inspected the system, and what did they find. A security firm with a published methodology offers an answer that a model card does not.
The commercial logic runs alongside a technical one. As OpenAI sells agents that read files, call tools and execute code, the amount of software that needs review grows with the number of tasks those agents perform. Code a language model writes still has to survive an audit, and the auditors are the scarce resource.
Competition for that talent has been building across the industry. Security researchers who can break a model or find a flaw deep inside a dependency graph are few, and the labs, cloud providers and banks all want them. Buying a firm is one way to acquire a team that would otherwise take years to assemble.
There is a counterargument, and it cuts against the deal. Consulting is a business of people, utilization and client relationships, not of software that can be run again at no cost. A research lab that measures success in products may find the economics of billable hours unfamiliar. Trail of Bits’ habit of publishing what it finds also sits awkwardly beside a parent company with an interest in what stays quiet.
The purchase would also put a model developer inside the business of certifying other companies’ software. Audits of that kind are used to satisfy insurers, regulators and enterprise buyers, and they carry weight because the auditor holds no stake in the product under review.
The two organizations have already tested the arrangement once. Patch the Planet put the firm’s engineers to work on the maintenance backlog of open-source software, the libraries and runtimes that enterprises depend on and rarely fund. The first week produced fixes in projects that sit inside almost every corporate stack. That is the kind of result a buyer can point to when arguing the purchase pays for itself in reduced exposure rather than in revenue.
Where the deal would land inside OpenAI is not clear. A security unit could serve the company’s own products, its enterprise customers, or both, and those are different businesses with different incentives. One improves the product that is sold. The other sells time and reports to outside buyers.
Software security has moved up the agenda for model developers for another reason. Models that act on a user’s behalf inherit the weaknesses of every system they touch, and a flaw in one dependency can be reached through an assistant that was never designed to guard it. The companies selling those assistants have learned that a breach is a product problem as much as a legal one.
The bigger question is what the transaction would signal. OpenAI has bought product teams before, folding their technology into its own. A services firm is a different kind of asset: it arrives with clients, contracts and a reputation built on independence. Absorbing it into a model developer changes what it is.
Regulators would have a limited role in a deal of this size, and neither company has said anything publicly. What is known is narrower than what is being inferred. Talks are under way, the reported deal size is unknown, and announcements of this kind sometimes end with nothing signed.
For OpenAI, the case rests on a claim it has been making to enterprises for a year: that its systems can be trusted with consequential work. Buying the firm that checks other people’s work is one way to argue the point. Whether a company built on publishing flaws can keep publishing them under new ownership is a question the talks have not yet answered.
