Two Labs, Two Flagship Discovery Programs, the Same Number Nobody's Fixed
Project Glasswing and OpenAI's Patch the Planet were built differently, run by competing labs, and cover different territory — Glasswing's coordinated disclosure model versus Patch the Planet's direct engineering partnership with Trail of Bits. But look at where both programs actually stand today, and they've converged on the same structural wall: finding vulnerabilities stopped being the hard part months ago. Getting them patched hasn't caught up, in either program, by anywhere close to the same margin.
What Patch the Planet actually is, and what it's found
OpenAI launched Patch the Planet on June 22, a Daybreak initiative built with Trail of Bits, pairing AI-assisted vulnerability research against critical open-source projects — cURL, Python, the Go project, aiohttp, Sigstore, and pyca/cryptography among the initial targets — with full human review by Trail of Bits security engineers before anything reaches a maintainer. The design choice is deliberate: Trail of Bits reproduces every finding's evidence, checks it against project-specific documentation, removes duplicates, and reassesses severity before a maintainer ever sees it, specifically to avoid flooding already-stretched volunteer maintainers with unverified AI output.
The early technical results were genuinely strong: eight Linux kernel pointer-leak proofs of concept and 24 local privilege-escalation exploits from a single pass across more than 30 million lines of code, a 23-year-old OpenBSD use-after-free confirmed exploitable, 34 confirmed FreeBSD vulnerabilities, and a Firefox WebAssembly CVE patched before Pwn2Own Berlin with no successful exploit demonstrated at the competition.
Where it stands now is the part that hasn't been covered here yet. Per security researcher Chris Hughes's September 6 analysis of the program's own published tracking, of the issues Patch the Planet has found, 66% are still awaiting a patch, and only 13% have actually been merged upstream.
The parallel to Glasswing is almost exact
This site has already documented this precise pattern once, on the other side of the AI-lab rivalry. VulnCheck's July report found Project Glasswing's disclosure ledger had produced 1,611 confirmed entries against an original claimed 23,019 findings — and Anthropic's own live disclosure dashboard, covered here in August, now shows real, genuine progress since: 2,300 disclosed, 421 patched. Run the same math on both programs and the picture is strikingly similar: Glasswing's patch rate sits around 18%, Patch the Planet's around 13%. Different companies, different model families, different disclosure philosophies, and both landing in the same narrow band — comfortably under one in five findings actually reaching a shipped fix.
Why this isn't a story about either company executing badly
The more useful reading isn't "OpenAI's program is underperforming" or "Anthropic's program is underperforming" — it's that AI-assisted discovery has decisively outpaced the human and institutional capacity required to validate, patch, test, and ship a fix, and that gap shows up almost identically regardless of which lab, which model, or which disclosure structure is doing the finding. Sergej Epp, the researcher behind the Zero Day Clock project (covered separately today), has a useful frame for why: exploit code has a cheap, deterministic verifier — it works or it doesn't — while a patch has to be correct everywhere, reviewed by people with limited time, and tested against a much larger space of things that could break. Discovery scales with compute. Remediation scales with maintainer attention, and maintainer attention hasn't gotten any more abundant just because the reports arrived faster.
Why this belongs in the same conversation as last week's coverage
This is the same asymmetry the Collective Cyber Defense letter named at the industry level, and the same one OpenAI's own $1 billion Daybreak for Frontline Defenders initiative is implicitly trying to address by funding capacity rather than just supplying more findings. Two flagship programs converging on nearly identical patch rates, independently, is a data point worth taking seriously: this isn't a problem either company can out-engineer on its own by improving the model. It's a capacity problem on the other side of the pipeline, and neither program has cracked it yet.