The Information: OpenAI in early talks to acquire security firm Trail of Bits, its Patch the Planet partner; neither company has confirmed

Why it matters

【Key points】

The Information (Oct 13; Valida Pau, Amir Efrati) says OpenAI is in early talks to acquire Trail of Bits, a New York software-security firm. Deal size unknown; talks ongoing and could fall apart; OpenAI wants a sizable cybersecurity business. Founded 2012, ~40 staff; audits open source and Web3 protocols (Uniswap, Aave). Reuters same day: neither company immediately commented; DIGITIMES and others followed. Neither has confirmed.

They already partner: on Jun 22 OpenAI launched Patch the Planet; Trail of Bits used Codex and GPT-5.5-Cyber on 19 open-source projects (cURL, Python, Go), hand-reviewing findings before maintainers. OpenAI: hundreds of issues found, dozens of patches merged in the first sprint.

【Verifiable】

The Information: https://www.theinformation.com/articles/openai-early-talks-buy-security-startup-trail-bits

Reuters via CNA: https://www.channelnewsasia.com/business/fbi-arrests-saudi-openai-engineer-over-covert-recording-device-doj-says-6457126

Patch the Planet: https://openai.com/index/patch-the-planet

Techmeme: https://x.com/Techmeme/status/2110148884739854575

X: ~250 posts over 9+ hours after ~22:00 UTC Oct 13 (14–44/h), multi-author, multilingual.

【Our read】

1. A deal buys a human audit team. Models find bugs at volume with many false positives; scarce skill is reproduce/rate/patch—capacity to productize GPT-5.5-Cyber / Codex Security.

2. Independence is the open question. Third-party status is the brand; after an OpenAI sale, does it still count as an outside view on OpenAI’s stack, and do other clients stay?

3. The Information led; Reuters relayed with no comment. Early and unconfirmed—credible but not confirmed. Watch for official comment and whether Trail of Bits keeps auditing other labs.