OpenAI outlines a five-stage response plan for AI-found critical bugs
Original title: AI-found bugs are expected to rise, and OpenAI has a five-stage response plan
The plan follows a two-month PHP response in which Calif and Wiz independently found the flaws.
OpenAI proposed a five-stage process for critical flaws that affect many products at once, based on its PHP vulnerability response. Calif found one PHP flaw with GPT-5.6 Sol under Patch the Planet, and Wiz independently found and reported both. Stages run from maintainer confirmation and patch testing, including checks by frontier models, through early notice to distributors and providers, government engagement, a wider operator circle, and post-patch guidance. OpenAI says maintainers decide who is told early, using protective role, time needed, and ability to handle sensitive information.
Unconfirmed: OpenAI expects similar AI-found vulnerabilities to rise sharply; that forecast is the company’s own projection.
- For PHP, partners included the White House Super Intelligence Force, ONCD, and CISA.
- Participants may receive anything from compromise indicators to working proof-of-concept exploits.
- Timelines would be revisited if a flaw is exploited, leaks, or remediation stalls.
- OpenAI asks how long disclosure windows should last and how to patch unmaintained versions.
- It also asks whether authorized operators may use a flaw to regain lost administrative access.
- Vendors
- OpenAI
- Products
- PHP
- Organizations
- CalifWizCISAOffice of the National Cyber Director
- AI models
- GPT-5.6 Sol
From the original article
2 min read at helpnetsecurity.com
OpenAI has proposed a five-stage process for handling critical vulnerabilities in widely used software. The process grew out of a two-month response to flaws in PHP, the open-source language that runs websites and web applications. Calif found one of the PHP flaws using OpenAI’s GPT-5.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.