OpenAI Eyes Acquisition That Could Boost Cybersecurity Business

OpenAI, which is trying to develop a substantial cybersecurity business, is in early talks to buy Trail of Bits, a firm that finds and fixes vulnerabilities in open-source software, according to people familiar with the matter.

The size of the potential deal couldn’t be learned. OpenAI has sometimes paid in the low hundreds of millions of dollars in the form of stock to acquire small startups, though it sometimes pays less. Discussions are ongoing and the deal could fall apart, said the people.

The startup’s staff could aid one of OpenAI’s most promising business opportunities. This year, OpenAI and its archrival Anthropic have tried to one-up each other in developing specialized AI for identifying vulnerabilities in software.

Founded in 2012, Trail of Bits provides security research and tools while helping to maintain open-source projects. It has a team of more than 40 employees, mostly security engineers, according to its website. Instead of typical venture funding, it received a grant of around $10,000 from the Department of Defense in 2015 and a $1 million loan in 2020 from the federal paycheck protection program.

In June, the startup partnered with OpenAI to work on a software-patching initiative, Patch the Planet. Staff from Trail of Bits work on open-source projects, such as the popular programming language Python, to find, review and fix bugs, with the help of OpenAI Codex tools, including models specialized for cybersecurity.

“We had a lot of existing relationships in the open source community and have earned their trust over more than a decade of work,” said Trail of Bits CEO Dan Guido in a promotional video announcing Patch the Planet. “Codex enabled our team to ship things in a day that would have otherwise taken us weeks of time.”

Security has been a focus for AI labs as models have advanced. Hackers have already used publicly available AI in a slew of cyberattacks around the world, according to independent security researchers. Last week, Crowdstrike said the perpetrator of a recent hack of South Korean financial institutions used an open-source Chinese AI agent and Chinese large language models.

OpenAI and Anthropic, in coordination with the White House, have allowed other large businesses to use their most advanced models to find and patch security vulnerabilities in their own software. The AI providers have neutered such capabilities for models they have released to the broader public because of the potential for malicious actors to use the models in attacks.

Cybersecurity software firms such as Palo Alto Networks also have utilized models from OpenAI and Anthropic to boost the products they sell to businesses.

In another sign of its ambitions in cybersecurity, OpenAI recently hired Dali Rajic, a former executive at the Google-owned cloud cybersecurity unit Wiz, as its chief revenue officer.