Patch the Planet: global response coordination as agents uncover vulnerabilities

> To our knowledge, frontier AI found these vulnerabilities before attackers did

I don't know who/what Calif is and there's no link to them, so if I were only reading this article I would definitely get the impression that "AI did all the work here".

It’s just gross and manipulative. You have no moat, get over it

pAtCh ThE pLaNeT today, tomorrow it's creepy rent-seeking behavior

Most people license out the software under specific requirements and prohibitions. BSD requires attribution. GPL variants require adherence to copyleft when distributing derivative works. A little under half of all github repos don't even have a license, which means that though the source is published, no one has any license under which to copy it or derive new works from it.

So far as I have seen, whether aggregating and munging these works into abstract LLM weights constitutes fair use is still legally unclear. If not deemed fair use, it is almost certainly a massive violation of copyright.

That is, they knowingly and willingly broke the law by stealing an unprecedented volume of proprietary, copyrighted materials.

Books: Bartz v. Anthropic

Films and TV: Disney Enterprises Inc. v. Midjourney Inc.

Music: Concord Music Group, Inc. v. Anthropic

Photography: Getty Images v Stability AI

Journalism: Postmedia Network Inc., Torstar Corporation, The Globe and Mail Inc., and The Canadian Press v. Anthropic PBC

Or at least just childishly naive for failing to notice that beforehand.

The point of the open source I work on is to contribute to a commons, not to have it stolen so that it can be used to destroy those commons, used for the profit of techbros, and used to justify the murder of children.

This works for established profitable brands that want to build / maintain a good public image.

This isn’t the marketing needed by an unprofitable startup that wants to show hyper growth before its IPO. They need the “use our product or get pwned” kind of marketing.

Last I checked, white hat security researchers weren't making their livings selling superhuman hacking tools to unknown entities as part of ~$1T businesses desperate to offload their shares onto the public before a potential bubble pop.

If you want to argue what they're doing is fine regardless, be my guest, but using this comparison as the justification is a little ridiculous.

1. OpenAI started the current AI cycle

2. That cycle has exposed exponentially more security vulnerabilities due to agentic coding

3. OpenAI is rushing as fast as they can to reach the singularity even while acknowledging that they lack the ability to ensure reasonable safety.

4. They launch an initiative to “address” the security vulnerabilities by using their coding tools.

Am I missing something? There is a broad range of motives and responses.

Then, someone releases a pick that works for many more locks humans couldn't pick.

And says: You can't stop the progress. Now pay us to upgrade your locks (no-no, they won't be doctored to fit our next-gen picks, trust us!)

OpenAI released the tool that FINDs the exploits. They don’t need to publish them to be complicit.

The entire article is form over content, it boils down to obvious: economics changed, LLMs actually can check every minor release diff for security fixes, including decompiling binary files; if you have any idea how to improve process of releasing updates, tell us.

You're not required to disclose bugs, nor is developing exploits a criminal offense (assuming no intent/conspiracy to hack stuff).

> 1 August 2026 [...] Ryan Austin finds the RCE paths, tweets a cryptographic hash on 5 August, and submits the bug and working RCE proof-of-concept to PHP between 11 August and 14 August.

> 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August.

I get some skepticism about marketing copy, but your comment is blatantly wrong and needlessly rude.