OpenAI Reportedly in Talks to Acquire Trail of Bits: Why Are Model Companies Racing to Snap Up Security Teams?

Original | Odaily (@OdailyChina)

Author | SuDiXia@Odaily

According to foreign media outlet The Information, OpenAI is in early acquisition talks with New York-based cybersecurity firm Trail of Bits. The deal amount has not been disclosed, and neither party has publicly confirmed the news so far. The report notes that the core purpose of this potential deal is to help OpenAI build a more complete cybersecurity business line.

Founded in 2012, Trail of Bits was started by three security researchers without external funding and currently has a staff of around forty. The company does not sell itself on "fast reports," but instead bundles research, tool development, and hands-on auditing together, with deep expertise in cryptography, low-level systems, application security, and blockchain security. It has a particularly strong reputation in smart contract auditing, with projects like Uniswap, Aave, Worldcoin, and Arbitrum having engaged it for reviews. The open-source tools it maintains—Slither, Echidna, and Manticore—have become part of the standard toolchain used daily by many blockchain teams.

Public information shows that Trail of Bits' client list is not limited to crypto projects. It has long participated in DARPA-related programs, placed well in the Cyber Grand Challenge, and in recent years has also taken part in the AI Cyber Challenge. The company's consistent approach is to open-source the methodologies distilled from its research rather than locking knowledge inside client reports. This style makes it somewhat unusual in the security world—it does high-priced custom audits while continuously releasing tools and papers into the public domain.

In fact, the two sides had already collaborated as early as June this year. OpenAI and Trail of Bits jointly launched the "Patch the Planet" initiative, part of OpenAI's Daybreak program, aimed at using OpenAI's then more capable models (including GPT-5.5-Cyber) to scan open-source projects, with Trail of Bits engineers then verifying, reproducing, writing patches, and coordinating merges with maintainers—rather than dumping model output directly onto open-source projects.

The first week's sprint covered 19 projects, including foundational libraries and infrastructure components such as cURL, Python, Go, pyca/cryptography, Sigstore, aiohttp, and NATS. According to data published by Trail of Bits, the collaboration identified hundreds of issues and submitted 64 pull requests and 51 issues, with 37 patches already merged at the time of the announcement. Follow-up tracking showed that by around mid-September, of the 186 PRs with results, approximately 68% had been merged by maintainers, with most accepted with little to no security-related modification to the original proposal. Maintainers closed unmerged PRs mainly because they were superseded by other work or out of scope—very few were explicitly rejected on technical grounds.

Open-source maintainers have long faced the problem of "too many reports, not enough hands." Models can accelerate discovery but also amplify noise. Trail of Bits acted as a filtering and patching layer in between, effectively binding "discovery" and "fixing" together. Some project maintainers later reported that compared to the flood of AI-generated reports they had received in the past, these reports were of higher quality, with proper reproductions and clear impact statements.

For OpenAI, this collaboration amounted to testing its models' performance on security tasks in real-world scenarios, and also validating whether the "model + professional security engineer" combination could work. If the acquisition ultimately happens, what OpenAI gets is a group of people who have long done low-level security research, can write tools, and are accustomed to collaborating with the open-source community.

Currently, model companies face no small pressure on security. As model capabilities improve, they can be used both to find vulnerabilities and, more easily, to craft attacks. OpenAI itself is also pushing defense-oriented products like Daybreak. Bringing in a team like Trail of Bits amounts to adding an internal research force capable of continuously producing security capabilities and tools.

From a broader perspective, traditional companies have already gone through several rounds of acquiring to shore up crypto or on-chain security capabilities.

In 2021, Mastercard acquired CipherTrace, which builds blockchain analytics and cryptocurrency anti-money laundering tools, primarily serving banks, exchanges, and regulators. After the acquisition, these capabilities were integrated into Mastercard's digital asset risk control and compliance systems.

In 2020, PwC Switzerland brought in the ChainSecurity team, spun out of ETH Zurich, to strengthen smart contract auditing and formal verification capabilities for clients with crypto asset-related needs.

In September of this year, S&P Global announced an agreement to acquire OpenZeppelin. OpenZeppelin maintains widely used open-source smart contract libraries and has conducted extensive security reviews; S&P's intent is to incorporate on-chain technology risk into its ratings and risk assessment framework. After the acquisition, OpenZeppelin will continue to operate independently, retaining its brand and key leadership. (Recommended reading: "S&P, the Company That Rates the World, Bought a Crypto Security Firm")

The common thread across these deals is clear: most acquirers are not aiming for a full pivot into crypto business, but rather coveting a specific capability they lack—whether compliance monitoring, smart contract review, or on-chain technology risk—to serve existing institutional clients or strengthen their own infrastructure.

If OpenAI proceeds with this deal, the purpose is roughly the same: at a stage when model capabilities are rising rapidly and security demands are rising in tandem, to add a proven professional security research and execution capability. The talks are still at an early stage, with no formal confirmation and no pricing information leaked.

For a company like Trail of Bits that is accustomed to making its tools and research public, whether the degree of research openness will change after being absorbed into a larger platform has become a focus of outside attention. For the open-source security ecosystem, if more model companies directly bring professional security teams in-house, the pace of "finding vulnerabilities" and "fixing vulnerabilities" may diverge further in the future.