Yet another Hacker News

Patch the Planet: global response coordination as agents uncover vulnerabilities

91 points nr378 1 hour ago 46 comments

bcvvvy 1 hour ago | parent

We enabled the disease and provided the vaccine!

ex1fm3ta 1 hour ago | parent

hmmm not sure about this one, the disease was already there it just available to anynone (not only for state sponsored actors) and the vaccine is globally available at a fraction of what it cost to build it.

Noaidi 46 minutes ago | parent

The disease is unleashing these powerful AI tools to the public before even thinking about the risks.

Noaidi 45 minutes ago | parent

The AI economy profits solely off of the broken window fallacy.

gruez 14 minutes ago | parent

But the window was arguably already broken? The opposite would be something like the "bury-head-in-sand economy"?

scottgg 1 hour ago | parent

Did they actually do anything good here ? Is this really marketing in the middle of this shitshow ?

Ajedi32 1 hour ago | parent

They found a vulnerability and reported it; isn't that a good thing? Are you suggesting it would be better to just not look for vulnerabilities, hoping that if nobody knows they exist, they can't be exploited?

I thought that logic had been widely discredited in the security community long ago.

ilogik 1 hour ago | parent

Calif found the vulnerability, not OpenAI

nicce 1 hour ago | parent

Wiz claims they they found it with Gemini? I have no idea who actually found it.

Edit: Apparently both found independently

Ajedi32 49 minutes ago | parent

> Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative

Noaidi 47 minutes ago | parent

If they can find the vulnerability anyone can. This whole "patch the planet" is marketing trying to cover up for the danger AI is unleashing on internet infrastructure.

Maxious 1 hour ago | parent

> 1 August 2026: 2 days after OpenAI invites Calif to join its “Patch the Planet” initiative, Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.

https://deadneurons.substack.com/p/php2shell-explained-php2s...

fock 1 hour ago | parent

yes, they sat on a working exploit for 2 months to hone their magic "this exploits everything"-script. In other words: criminals.

gruez 1 hour ago | parent

>In other words: criminals.

You're not required to disclose bugs, nor is developing exploits a criminal offense (assuming no intent/conspiracy to hack stuff).

NitpickLawyer 58 minutes ago | parent

No idea what your comment is even about. The researchers that found and reported this did not sit on this for 2 months.

> 1 August 2026 [...] Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.

> 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August.

I get some skepticism about marketing copy, but your comment is blatantly wrong and needlessly rude.

fock 53 minutes ago | parent

oh, so you say they only sat on it for a week? And then they exhaustively searched all exploit-paths so they have a demo ready 2 months later?

NitpickLawyer 44 minutes ago | parent

> so you say they only sat on it for a week?

This is absurd, and it shows that you have absolutely 0 idea of how any of this works. Finding a bug and delivering a working RCE 11 days later is absolutely not "sitting on it". This is how this works. You need time to test, exploit, confirm, and so on. Sorry, but just stop being so negative. This can't be healthy for you.

yearolinuxdsktp 1 hour ago | parent

Patch the Planet? Not with OpenAI tools.

How much time will be left in the Defender’s Window between now and an organization getting Daybreak Access?

nr378 1 hour ago | parent

It seems like OpenAI are trying to frame this as if AI did all the work here, but it's not really true given what Calif say (https://calif.io/php2shell/):

> How did we find this?

> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.

> There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.

openclawuser 1 hour ago | parent

In 2024 I saw a reddit post answering the question: AI is going to program insert name App.

Response: "What's the prompt?"

Yep. I might take minimum wage interns and make million dollar software(or million dollars in 2023), but they often run into issues that a 5 minute review with me solves.

I do wonder if AI is going to eliminate prompt engineering... It's basically all I have left. I feel like I have magic words.

nemomarx 47 minutes ago | parent

I can't think of how it'll really eliminate prompting, but needing to carefully phrase your language already seems in the way out? Wasn't one of the prompts leading to solving fields problems just "look for fields problems and try very hard" or the equivalent

Jeep_ 1 hour ago | parent

Pure marketing, it's getting increasingly hard to separate actual technical feats of agents from marketing pretentious declarations. Such a terrible environment to navigate right now.

Frieren 1 hour ago | parent

Not marketing. It is a crime related to fraud or securities fraud.

orangedog 1 hour ago | parent

You're claiming this is securities fraud?

recursive 56 minutes ago | parent

Not only that, but everything else is also securities fraud.

redanddead 49 minutes ago | parent

What’s worse is that this is part of a larger strategy of scaring the public to get regulatory capture

It’s just gross

shimman 42 minutes ago | parent

It's not hard tho, the default mode of thinking should be to never trust what a US corporation says.

giantg2 30 minutes ago | parent

Why limit only to the US?

Frieren 1 hour ago | parent

> OpenAI are trying to frame this as if AI did all the work here

CEOs of all big corporations are constantly lying and misleading the public, investors and shareholders. That is a crime. A shame that it is not enforced anymore.

12837615 1 hour ago | parent

The commit $1 billion in tokens to "defenders". $1 billion directly to QA for open source projects [1] which would write 100% code coverage, run ASAN and fuzzers would be more effective.

But of course there would be no marketing.

[1] From whom you stole everything in the first place.

orangedog 1 hour ago | parent

To be pedantic, would that not be marketing?

To be further pedantic, is that really stealing? They are disregarding copyright but was anything taken from anybody? I thought that was the old argument for piracy, ie, nobody was deprived of anything.

moregrist 1 hour ago | parent

It’s marketing, but in a global good will sense of “look how much OpenAI cares about secure open source.”

This works for established profitable brands that want to build / maintain a good public image.

This isn’t the marketing needed by an unprofitable startup that wants to show hyper growth before its IPO. They need the “use our product or get pwned” kind of marketing.

fritzo 20 minutes ago | parent

I'm as frustrated as the next open source maintainer, but "stole" goes too far. We gave that code away with pride, knowing the world would be a better place.

RomannBami 51 minutes ago | parent

l'IA est simplement un outils ce sont les ingénieurs derrière qu'ils faut féliciter pour leur travail acharné.

redanddead 50 minutes ago | parent

Feels like a marketing campaign lol

podgorniy 37 minutes ago | parent

Point me at anything what _these people do_ that is not a marketing or _confusion_ campaign.

thewillowcat 32 minutes ago | parent

I would simply write code that doesn't have vulnerabilities in the first place.

alper 19 minutes ago | parent

> How can we help identify and fix vulnerabilities in downstream packages while upstream fixes are pending, or backport fixes to older versions that no longer receive security updates?

Is the company selling a magical code generation machine really asking how it can backport a fix to an older version of the same software?

Is this for real?

wildmXranat 17 minutes ago | parent

So much fluff and marketing from every group.

Just give us the damn code to verify things are working since so many have to use stopgap solutions and want to verify them

alper 11 minutes ago | parent

The marketing around the response I would bet is the main reason why they couldn't keep it secret.