AI-found bugs are expected to rise, and OpenAI has a five-stage response plan

OpenAI has outlined a five-step framework for coordinating disclosure of critical vulnerabilities that affect widely-used software, prompted by a two-month response effort tied to flaws discovered in PHP. One of these PHP bugs was surfaced by researcher Calif using OpenAI's GPT-5.6 Sol model under the company's Patch the Planet open-source security initiative, while security firm Wiz separately identified and reported both issues. The proposed process moves from initial confirmation and patch development, through early notification to affected vendors and distributors, government involvement (including CISA and the White House's Super Intelligence Force for the PHP case), broader disclosure, to final public guidance after a fix ships. OpenAI says it expects AI models to uncover this kind of large-scale, high-impact vulnerability far more often going forward, and is seeking industry input on disclosure timing, information-sharing risks, and how to patch outdated software versions no longer receiving security updates.