OpenAI proposes a five-stage process for coordinating fixes when models find critical bugs

OpenAI says it led a coalition of maintainers, researchers and security providers on the PHP vulnerabilities, that Calif found a critical flaw using GPT-5.6 Sol, and that Wiz independently found and reported both. The post states: "To our knowledge, frontier AI found these vulnerabilities before attackers did." It proposes five stages: validate and fix upstream, give affected organizations time to act, coordinate with government partners, prepare updates across products, and publish guidance once a patch exists. It also commits $1 billion in subsidized access to its Daybreak security program for under-resourced defenders, and says it expects similar findings to increase sharply in the coming months.

This is a proposal, not an adopted standard, and OpenAI sells the access it is subsidizing. The post asks for feedback on open questions, including when governments or operators should patch systems they own after losing administrative access.

Why it matters: If model-found critical bugs do become routine, maintainers will need a defined process for who is told what and when. The questions OpenAI leaves open, disclosure windows and emergency patching, are the ones to watch before treating this as a framework.