OpenAI says its models found PHP2Shell and led a two-month coalition to fix it. It's the same AI that broke into Hugging Face and an Australian government portal this year.
In brief OpenAI President Greg Brockman said the company led a two-month coalition to fix PHP2Shell, found with its models under its Patch the Planet initiative. Security firm Calif used GPT-5.6 Sol to find a version of the bug in August; OpenAI found a fuller version in September, and Wiz found both flaws independently. Brockman called for authorized defenders, such as governments, to scan for vulnerable servers and, in extreme cases, patch them remotely.