OpenAI is in early talks to buy Trail of Bits, a firm that finds and fixes vulnerabilities in open-source software, according to people familiar with the matter cited by The Information. The size of the potential deal could not be learned, and the discussions are ongoing and could fall apart. Founded in 2012 and based in New York, Trail of Bits develops and maintains more than 100 open-source security projects, including the Slither static analyzer and the Echidna fuzzer, and counts Google, Meta, Microsoft, Zoom and DARPA among its clients. The two organizations already worked together in June on "Patch the Planet," a program in which Trail of Bits engineers used OpenAI's Codex family of tools to find, review and patch vulnerabilities in popular open-source projects such as Python. The move is part of OpenAI's push to build a substantial cybersecurity business, where it competes with Anthropic on AI for vulnerability discovery.