M&AOct 15, 2026, 04:07 UTC

OpenAI eyes security firm Trail of Bits in cybersecurity push

What's the deal? OpenAI is in early talks to acquire Trail of Bits, a New York software security firm that finds and fixes vulnerabilities in open-source projects, The Information reported. The size of a potential deal could not be learned, though OpenAI has sometimes paid in the low hundreds of millions of dollars in stock to buy small startups.

Who is Trail of Bits? Founded in 2012, it employs more than 40 people, mostly security engineers, and helps maintain open-source projects. Rather than raising venture capital, it took a roughly $10,000 Department of Defense grant in 2015 and a $1 million federal paycheck protection loan in 2020.

Why now? The two have worked together since June on Patch the Planet, which pairs Trail of Bits engineers with OpenAI's Codex and GPT-5.5-Cyber models to hunt bugs in libraries like Python, cURL, and Go. "Codex enabled our team to ship things in a day that would have otherwise taken us weeks of time," said Trail of Bits chief executive officer Dan Guido.

What's the endgame? OpenAI is "attempting to build a sizable cybersecurity business," per the reporting. It recently hired Dali Rajic, a former executive at Google-owned cloud security unit Wiz, as chief revenue officer.

What could go wrong? Discussions are ongoing and the deal could fall apart, the people said.

The signal: OpenAI and rival Anthropic have spent the year competing to build AI that identifies software vulnerabilities, a dual-use capability both labs restrict in public models to deter attackers. Buying a trusted auditing team turns enterprise security from a safety concern into a product line — and gives frontier labs a foothold in a market where firms like Palo Alto Networks already run on their models.