OpenAI's Patch the Planet disclosure framework: the five stages for AI-found vulnerabilities, how PHP2Shell tested it, and what it changes

OpenAI's Patch the Planet disclosure framework is a proposal, published on October 21, 2026, for how to handle critical bugs in widely used software once AI agents start finding them faster than maintainers can fix them. It lays out five stages, from a quiet fix to public guidance, and it arrived the same day as its first real test: the PHP2Shell flaws, which OpenAI-backed researchers helped find and which leaked, and drew exploitation attempts, before the patches shipped. This analysis looks at what the framework says, how the PHP case went against it, and what it changes for maintainers and defenders in security.

This analysis is based on OpenAI's October 21 post and its earlier disclosure policies, the PHP Foundation's account of the PHP2Shell release, Amazon's and Wiz's posts, Google Project Zero's and Anthropic's published disclosure terms, and coverage by Help Net Security, TechCrunch, SecurityWeek and Techzine, checked October 22 and re-checked October 23, 2026. For the technical details of the PHP bugs, see our PHP2Shell story.

The short version

• What it is: a "proposed framework" under OpenAI's Patch the Planet initiative, not a binding policy. OpenAI asks the security community to improve it.
• The five stages: validate and fix; give affected organizations time; coordinate with governments; prepare updates more widely; publish guidance once a patch exists.
• Who decides: the maintainers choose who gets early information, weighing each party's protective role, the time it needs and whether it can keep a secret.
• No fixed deadline: timelines are reassessed if there's exploitation, a leak, a revealing public patch or stalled fixes.
• The PHP test: the bugs leaked a day before release and Amazon saw an exploitation attempt four days early, so the framework's "Defender's Window" was shorter than planned.

What is Patch the Planet?

Patch the Planet started on June 22, 2026 as a program, not a framework. OpenAI and Trail of Bits launched it under OpenAI's Daybreak security effort to help open-source maintainers "move from findings to fixes," with HackerOne and Calif supporting triage, disclosure and discovery. Participating projects get ChatGPT Pro, conditional access to Codex Security and API credits, as our Trail of Bits story explains. OpenAI was reported on October 13 to be in early talks to buy Trail of Bits, one of several moves covered in our roundup of AI security acquisitions.

The October 21 post adds a process for the hardest case: a critical bug with "internet-scale impact" that many products share. OpenAI says it has found "several significant vulnerabilities" and expects such findings to "increase sharply in the coming months." It doesn't give a count. It also announced $1 billion in subsidized access for under-resourced defenders through Daybreak for Frontline Defenders.

What are the five stages?

1. Validate and fix the upstream vulnerability. Maintainers, researchers and technical partners confirm the bug, assess its impact, and build and test a fix, including adversarial testing with frontier models to look for ways around the patch.
2. Give affected organizations time to act. Selected distributors, hosting providers and security vendors get advance information to prepare their own measures, such as backported packages or web application firewall rules.
3. Coordinate with government partners. Agencies help get guidance to critical infrastructure. For PHP, OpenAI names the White House's "Super Intelligence Force," the Office of the National Cyber Director, CISA and international partners.
4. Prepare updates across affected products. Once the fix and plan are stable, more distributors, providers and operators are brought in to close coverage gaps.
5. Publish guidance and support deployment. After a patch is out, responders publish exposure details, the authoritative update, interim mitigations and how to verify, and keep helping operators deploy.

Each participant gets only what its job requires, "from indicators of compromise to working proof-of-concept exploits," OpenAI says. It also acknowledges the core risk: "Even limited details can reveal a vulnerability."

Who coordinates?

In the PHP case, OpenAI led a coalition of maintainers, researchers and security providers, naming Calif, Wiz and Cloudflare "and others," while the PHP maintainers led the fix and release. The framework itself says maintainers make the final call on who gets early access. It doesn't name a neutral coordinator such as CERT/CC, and HackerOne, a founding Patch the Planet partner, doesn't appear in the October 21 post.

That puts an AI vendor at the center of a process that also includes governments and competitors. Wiz, for example, says it used Google's Gemini 4 Argon alongside OpenAI's GPT-5.6 Sol on the same bugs.

What did OpenAI's agents find, and how was the PHP window handled?

OpenAI's post says Calif found one of the two PHP flaws using GPT-5.6 Sol, with Wiz "also independently discovering and reporting both vulnerabilities." The PHP Foundation's account is more detailed. Calif began auditing PHP under Patch the Planet on July 30, 2026. On August 11, Calif's researcher and OpenAI separately reported the same out-of-memory root cause, which the Foundation then made its top security priority. Wiz and OpenAI reported further attack paths on August 24 and September 18. The Foundation also says a PHP core developer had first seen signs of the bug in 2024, during work on an earlier audit, and that the fix stalled through "a structural failure" of its own process.

The plan was a coordinated release on October 22. Instead, by the Foundation's account:

• October 20, around 15:00 UTC: the CVE IDs leaked online with a wrong CVSS score of 10.0, so the release moved up to October 21.
• October 20, around 20:00 UTC: Calif mistakenly published a proof-of-concept video, which was copied and spread.
• October 21, 07:41 UTC: Chainguard published images with the fix before the coordinated release, which the Foundation said "disregarded weeks of work."

Chainguard's CEO, Dan Lorenc, told The Register, as relayed by Techzine, that a researcher had told the company something was coming and that its team then found the same bugs with its own AI harness and a frontier model, and helped test the patches.

Meanwhile, Amazon says a honeypot logged a PHP2Shell exploitation attempt on October 17, four days before disclosure, and that it "remains unclear how the actor acquired exploit information." Amazon's CISO, CJ Moses, wrote that "defenders should not assume the public disclosure date is the earliest date of exploitation."

Measured against the framework, stages 1 to 4 ran for about ten weeks. OpenAI's post says "to our knowledge, frontier AI found these vulnerabilities before attackers did," which opened a "Defender's Window." The October 17 attempt doesn't contradict that claim, which is about who found the bugs first, but it shows the window closed before the plan did. The post doesn't mention the leak, the video or the early exploitation attempts. Amazon says it's unclear whether any of the attempts it saw would have succeeded.

How does it compare with other disclosure policies?

The difference is philosophical. Project Zero's fixed deadline, announced as part of a 2025 "Reporting Transparency" trial, pushes vendors to fix faster and accepts that some bugs go public unpatched. OpenAI's framework instead prioritizes giving defenders a head start before anyone else learns of the bug, which only works if the secret holds. Anthropic's OSS Scanner takes a third route: it sends unreviewed, model-generated reports straight to maintainers who opt in, and applies no deadline until a human has validated a finding, because, Anthropic says, "we do not feel comfortable forcing maintainers to carefully read each finding if we have not yet done the same."

What do critics and maintainers say?

No named outside expert had published a critique of the framework itself by October 23, 2026; Help Net Security's October 22 coverage quotes only OpenAI. OpenAI's post itself invites "recommendations for independent security experts who can review the approach." The criticism so far is about the PHP case and its context:

• Maintainer capacity. The PHP Foundation says AI-assisted research means its security team gets "far more reports than before," with more than 100 invalid, duplicate or unreproducible ones since July 1. A PostgreSQL committer described a similar squeeze, with AI-assisted review finding defects faster than developers could fix them, as our Postgres 19 story explains.
• Embargo discipline. The Foundation publicly criticized Chainguard's early images. Chainguard's account suggests a frontier model can rediscover a bug within hours of a vague tip, which shortens any embargo.
• Hype and fake exploits. Elias Taylor argued on October 21 that public PHP2Shell proofs-of-concept "do not work against a vanilla PHP instance" and blamed people trusting LLM output without testing it.
• Motives and access (Tier 3). In the Hacker News thread on OpenAI's post (265 points and 183 comments on October 23), commenters asked whether the post was marketing, timed to a messy release, and asked how much of the "Defender's Window" is left for organizations without Daybreak access. No commenter identified as a maintainer.

OpenAI raises some of the hardest questions itself. It asks for input on disclosure windows, how to fix old package versions that no longer get security updates, and whether governments or operators should use a vulnerability to patch systems they own or manage after losing administrative access. Help Net Security reports that OpenAI sketched an end state of "always-on, internet-wide scanning that either alerts site owners or patches the system itself." That last idea, patching other people's machines, would need legal and policy answers the framework doesn't attempt.

What it changes

For maintainers of very widely used projects, the framework describes a process they may now be invited into, with an AI company organizing distributors, vendors and governments around their fix. For everyone else, PHP2Shell is the practical lesson: the first public signal may be a leak, not an advisory, and exploitation can precede the patch. Amazon's advice to start investigations from October 17 rather than October 21 is the kind of guidance that the fifth stage now has to include. The same week, a stolen-credential attack on an AI developer tool's release pipeline showed the supply-chain side of the problem, covered in our LiteLLM 1.107.0 guide.

What's confirmed, reported and uncertain

• Confirmed (OpenAI): the five stages, the decision factors, the absence of a fixed deadline, the PHP partners named, the $1 billion Daybreak subsidy, and OpenAI's open questions.
• Confirmed (PHP Foundation): the August 11 reports, the October 20 leak, Calif's video, and Chainguard's early images.
• Reported: Amazon's October 17 observation (Amazon's own data); Chainguard's AI rediscovery (The Register via Techzine); the "always-on scanning" end state (Help Net Security's summary).
• Uncertain: whether other AI labs or neutral coordinators adopt the framework, how it would handle a bug found by a competitor's model, and whether governments would accept a role in remote patching.