Senior Software Engineer

Patch the Planet: a Daybreak initiative to support open source maintainers. Nowletus is introducing Patch the Planet, a Daybreak initiative built with Trail of Bits to help maintainers strengthen the critical open-source software the world relies on. Nowletus is pairing AI-assisted security research using its most cyber-capable models with expert human review to not only identify vulnerabilities, but help patch them. AI is accelerating vulnerability discovery, but discovery alone does not protect users. Many maintainers are already being asked to sort through more reports, more quickly, with the same limited time and resources. Patch the Planet is built to reduce that burden, not add to it: security engineers review findings before they reach maintainers, work with projects to develop patches and tests, and build reusable workflows that help teams continue improving security after the first fixes land. Trail of Bits has committed their entire security research organization(opens in a new window) towards this effort for its initial surge. They are working directly with maintainers to investigate and validate vulnerabilities, develop and test patches, and coordinate disclosure of vulnerabilities. Additionally, Nowletus will be partnering with HackerOne and Calif who are helping Nowletus take its efforts further with vulnerability triage, coordinated disclosure, and additional focused vulnerability discovery efforts. Each engagement under Patch the Planet begins in consultation with the maintainer. For each collaboration, security engineers work with maintainers to understand each project's needs, preferences, and where additional security effort would be most useful: vulnerability validation, patch development, CI/CD improvements, or longer-term security engineering. Once aligned, researchers investigate potential vulnerabilities, validate meaningful issues, develop or refine patches, support testing, and coordinate disclosure through the project's established channels. Initial participants include cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, the Go project, freenginx, Python, and python.org. These projects support widely used networking, cryptography, software supply chain, and language infrastructure, where stronger security can benefit a broad range of downstream products and services. Additional projects will join in future rounds. Security researchers are equipped with its frontier models as well as Codex Security(opens in a new window) to support the analysis, patch development, testing, and documentation. Participating projects receive access to ChatGPT Pro; conditional access to Codex Security; and API credits for core open-source development, maintainer automation, and release workflows. Trail of Bits has developed AI-assisted workflows for deduplication, triage, and patching that projects can run with this support. Trail of Bits has dedicated security engineers to work full-time with Codex and GPT-5.5-Cyber across 19 open-source projects, and has already identified hundreds of security issues and merged dozens of patches, with many more still undergoing coordinated disclosure. The initial sprint also produced reusable security infrastructure: fuzzing harnesses, historical-CVE analysis pipelines, differential-testing systems, threat models, expanded test suites, and workflows for deduplication, false-positive filtering, severity correction, and patch generation. Some project-specific details will be shared later as testing, remediation, and coordinated disclosure progress. A few early examples show what the team was able to build and find: A fuzzing lab in less than a day. Trail of Bits engineers used repeated Codex /goal runs with GPT-5.5-Cyber to build an entire fuzzing lab covering dozens of entry points, variant builds, platforms, and novel test seeds. Engineers set the objectives and refined the prompts; the system then used coverage feedback to keep expanding into new surfaces, target edge cases, and filter weak or invalid candidates. Trail of Bits engineers found that, with limited guidance, GPT-5.5-Cyber made useful choices about where to expand coverage, which builds and entry points to probe, and which candidates were too weak to pursue. The completed setup took less than a day. Trail of Bits estimates that building the same lab manually would ordinarily take at least several weeks. A reusable pipeline for finding variants of known vulnerabilities. The team built an end-to-end system that ingests historical CVEs, extracts relevant vulnerability patterns, searches target codebases for related flaws, and sends candidate findings through specialized judging agents. The pipeline deduplicates results, filters likely false positives, and routes the strongest evidence to security engineers for manual confirmation. This turns years of public vulnerability history into a repeatable search strategy that can be applied across projects. Trail of Bits found the models especially effective at this kind of variant analysis, which uncovered many additional issues across the codebases under review. Differential testing in days instead of weeks or months. Different implementations of the same protocol should usually behave the same way under the same inputs. When they diverge, one may contain a bug. Applying this idea at scale is normally difficult because engineers must write custom shim and glue code connecting each implementation to a common test harness. Codex generated and iterated on that code, allowing multiple implementations to be fuzzed against one another and their behavioral differences investigated. The workflow filtered many weak or invalid results and produced a comparatively high-signal set of candidates for expert review. The team reached those results within days, compressing work that has historically taken weeks or months. Trail of Bits is continuing to expand and refine these tests before publishing project-specific details. Testing software against the behavior its specifications promise. The teams used Codex to develop threat models, attack taxonomies, invariant tests, and property-based tests grounded in project specifications and RFCs. These methods exposed notable differences between intended and actual behavior while leaving projects with broader test coverage, stronger documentation, and improvements to CI/CD and software-supply-chain tooling. Security engineers reviewed every finding before it reached a maintainer. Trail of Bits engineers manually reviewed every security issue before it was submitted to a maintainer, and the added value of this step cannot be understated. While frontier AI models are highly capable of finding vulnerabilities and patching them, they also produce a high volume of false positives that can contribute to the already overwhelming backlog maintainers are facing. Patch the Planet solves for this by having dedicated Trail of Bits researchers reproduce the evidence, check findings against project-specific documentation and threat models, remove duplicates, reassess severity, and prioritize confirmed vulnerabilities for remediation. They also develop and submit patches in accordance with maintainers preferences. Maintainers remain in control of what patches are deployed and how disclosure is handled. Patch the Planet builds on a broader body of Daybreak work showing how frontier models can help defenders find, validate, and remediate serious vulnerabilities in widely used software. Nowletus is sharing a few early highlights here, while withholding exploit mechanics and project-specific details where disclosure is still underway. As fixes land and coordinated disclosures conclude, Nowletus plan to publish deeper technical reports that walk through individual findings, research methods, validation workflows, and lessons other defenders can apply. Its findings span every layer of the software stack, with many more still in the disclosure process. **Linux Kernel:**GPT-5.5-Cyber identified security-relevant components across more than 30 million li Ad slot ready: 5887729102 Discover more Data Management

OpenAI releases gpt5.5cyber with full automation for vulnerability detection and patching. June 22, 2026 OpenAI has officially launched the full version of GPT-5.5-Cyber, a specialized AI model engineered for advanced vulnerability detection, patch generation, and automated remediation at machine speed. The release is part of OpenAI's broader Daybreak initiative, which aims to democratize defensive cybersecurity capabilities for trusted organizations worldwide. GPT-5.5-Cyber delivers state-of-the-art results across three major cybersecurity evaluation benchmarks: * CyberGym: 85.6% (vs. 81.8% for GPT-5.5), the highest single-model score recorded. * ExploitGym: 39.5% (vs. 25.95% for GPT-5.5), testing exploit generation from known vulnerabilities. * SEC-bench Pro: 69.8% (vs. 63.1% for GPT-5.5), evaluating long-horizon vulnerability discovery across complex software targets. The model can navigate large codebases, trace attack paths, validate exploitability, generate targeted patches, and produce remediation evidence all within a single automated workflow. Codex Security plugin updated. Alongside the model release, OpenAI has updated the Codex Security plugin, now capable of deep codebase scanning with automated patch generation. Since launching in research preview in March 2026, Codex Security has: * Scanned over 30 million commits across more than 30,000 codebases * Processed over 70,000 manually verified fixes * Automatically resolved over 500,000 findings The plugin integrates directly into developer workflows, supporting SARIF exports, CodeQL queries, and existing vulnerability management pipelines. It generates severity-rated reports with affected code locations, attack path tracing, and codebase-specific patches for human review. OpenAI launched Patch the Planet, a collaborative initiative co-founded with Trail of Bits and partnered with HackerOne and Calif, to address the critical vulnerability remediation gap in open-source software. More than 30 open-source projects have committed to participate, including: * cURL, Go, Python, Sigstore, and pyca/cryptography An initial five-day sprint across multiple projects surfaced hundreds of issues, merged dozens of patches, and built reusable fuzzing and variant-analysis workflows. Participating projects receive ChatGPT Pro, conditional Codex Security access, and API credits. GPT-5.5-Cyber is distributed exclusively through a limited release to verified, trusted defenders. It is not available for general use. OpenAI has confirmed Trusted Access for Cyber partnerships with Australia, Canada, France, Germany, Japan, South Korea, and EU institutions, including ENISA. OpenAI coordinated pre-deployment testing with the Center for AI Standards and Innovation (CAISI) and worked with the Office of the National Cyber Director (ONCD) on the implementation of the June 2026 Executive Order on AI security. For most organizations, GPT-5.5 with Trusted Access for Cyber and Codex Security remains the recommended entry point, with GPT-5.5-Cyber reserved for defenders requiring the highest capability tier with enhanced monitoring and scoped controls. OpenAI's announcement signals a fundamental shift in the cybersecurity threat model. The historical bottleneck of finding vulnerabilities has given way to a new challenge: patching them at scale. With Daybreak unifying frontier AI models, Codex Security workflows, open-source partnerships, and critical infrastructure collaboration, OpenAI is positioning AI-driven remediation, not just detection, as the next frontier in cyber defense. Follow Simply Secure Group on Google News, LinkedIn, and X to Get More Instant Updates.

HackerOne introduces H1 Platform to advance Continuous Threat Exposure Management. June 2, 2026 HackerOne has unveiled the H1 Platform, a new agentic AI-powered system built to help organizations identify, validate, prioritize, and remediate security exposures on an ongoing basis. The announcement arrives as security teams face growing pressure from a surge in both software development and vulnerability discovery driven by artificial intelligence. AI-assisted coding has become a routine part of development workflows, while security tools are uncovering vulnerabilities at an increasing rate. As a result, many organizations are struggling to keep up with validation and remediation efforts. According to HackerOne, vulnerability submissions across its platform increased by 92% over the past year. The company also reported growth in critical and high-severity findings, while remediation capacity has not expanded at the same pace. The H1 Platform is designed to address that gap through agentic AI capabilities embedded throughout the Continuous Threat Exposure Management (CTEM) process. At the center of the platform is Hai, HackerOne's AI orchestrator, which analyzes exploitability indicators, remediation guidance, and attack activity to help security teams focus on the vulnerabilities most likely to create business risk. "In a world reshaped by frontier AI models, security can't afford to be static, theoretical, or siloed. It must be continuous, validated, and tied to business impact," said Nidhi Aggarwal, Chief Product Officer at HackerOne. "As exploit windows shrink and vulnerability volume accelerates, organizations need security systems that can continuously discover and validate what matters, prioritize action, and operationalize remediation at AI scale to continuously reduce cyber risk." HackerOne Chief Executive Officer Kara Sprague said the platform reflects changing security requirements as organizations adopt more advanced AI technologies. "The AI era demands a new kind of security platform: agentic, continuous, and operating at the speed of the threat. The H1 Platform closes the discovery-remediation gap that defines this moment, built on the only foundation that could make it work: the simultaneous trust of the Fortune 500 and the world's largest community of security researchers, sustained over more than a decade," said Kara Sprague, HackerOne's Chief Executive Officer. "As enterprises move from securing code to securing AI itself, the researcher community's role on this platform will only deepen." A key component of the platform is HackerOne's global community of security researchers. While AI-driven automation can accelerate testing and analysis, researchers contribute expertise in areas that remain difficult to automate, including business logic weaknesses, novel attack techniques, and multi-step attack paths. HackerOne says this combination enables organizations to focus on vulnerabilities that have been demonstrated as exploitable rather than relying solely on theoretical risk assessments. As organizations expand their use of AI systems, HackerOne expects researcher contributions to extend beyond vulnerability discovery into broader security intelligence and risk assessment activities. Platform Capabilities The H1 Platform combines exposure discovery, validation, prioritization, and remediation within a single operational environment. Key capabilities include: * Continuous agentic testing across the attack surface with exploitability validation informed by historical program data and attack-path analysis * Vulnerability prioritization based on exploitability and business impact * Remediation workflows integrated with platforms including Jira, GitHub, ServiceNow, Azure DevOps, Linear, and other enterprise systems * Agentic exploitation workflows that generate validated findings and route them directly to development teams * Executive reporting and analytics, including Return on Mitigation (RoM) metrics intended to help organizations assess exposure reduction and remediation effectiveness Customer Adoption and Results HackerOne reports that the H1 Platform is used by approximately 1,300 organizations worldwide, including 20% of Fortune 500 companies and several leading AI-focused enterprises. Across its customer base, the company says it has helped organizations reduce more than $32 billion in exposure risk and lower mean time to remediate (MTTR) by roughly 80%. One example comes from Canadian fintech company KOHO Financial, where security teams have used the platform to improve vulnerability management processes. "We went from a set-and-forget security program to one that actually keeps pace with how fast threats move," said Scott Brown, Security Lead, KOHO Financial. "Reducing median triage time by roughly 80% has changed everything. Our team focuses on what's confirmed and exploitable, and vulnerabilities get addressed before they become real risk."