OpenAI Proposes Five-Stage Disclosure Plan After PHP Flaws

OpenAI has proposed a five-stage coordinated disclosure framework for critical software vulnerabilities, built on its two-month response to two serious bugs in PHP. "To our knowledge, frontier AI found these vulnerabilities before attackers did," the company says, and expects "similar findings to increase sharply in the coming months."

Help Net Security reports that one of the PHP flaws was identified by security firm Calif using OpenAI's GPT-5.6 Sol model, as part of OpenAI's Patch the Planet initiative; Wiz independently found and reported both.

The stages run in order. Maintainers, researchers and partners confirm the bug, assess impact, and develop fixes, with frontier models used to test patches for workarounds and variants. Affected organizations then get an early-access window to adapt fixes, test mitigations and write firewall rules. Government engagement comes next, and OpenAI names the specific desks: the White House's Super Intelligence Force, the Office of the National Cyber Director, CISA, and international partners. The disclosure circle widens to further distributors, providers and operators as remediation plans solidify. After patches ship, responders publish guidance and keep supporting deployment.

The timeline is explicitly elastic. It compresses if a vulnerability is exploited in the wild, leaks, is exposed by an inadequate public patch, or if remediation stalls in ways that raise user risk. OpenAI's own line on how early-access notifications are written is blunt: "Even limited details can reveal a vulnerability."

The framework is paired with a $1 billion commitment to subsidize access to the company's Daybreak security offering through a program called Daybreak for Frontline Defenders, aimed at organizations with limited security resources that protect essential services. The PHP episode that produced the framework is still playing out in our prior coverage: AWS has since tied in-the-wild attacks to the two PHP bugs four days before the October 21 emergency patch shipped, which is the kind of pressure the five-stage plan is written to absorb.