OpenAI in Talks to Acquire Cybersecurity Startup Trail of Bits
nashnova research
OpenAI is in preliminary acquisition talks with cybersecurity firm Trail of Bits. A deal would fill a critical gap in open-source software security — one of the fiercest frontlines in its rivalry with Anthropic.
Who is Trail of Bits, and why would OpenAI want it?
Trail of Bits, founded in 2012, specializes in finding and fixing vulnerabilities in open-source software — code that anyone can use and modify. The team has over 40 people, nearly all security engineers.
The company never took traditional venture capital. It received a roughly $10,000 research grant from the U.S. Department of Defense in 2015 and a $1 million federal Paycheck Protection Program loan in 2020.
This means → its value is not in a balance-sheet valuation but in people and trust — a security team with real credibility in the open-source community, exactly what OpenAI cannot easily buy with money alone.
How deep is the existing partnership?
In June this year, Trail of Bits and OpenAI jointly launched "Patch the Planet," an open-source software repair program. Trail of Bits engineers used OpenAI's Codex tool — an AI that can automatically write code and scan for vulnerabilities — to audit projects like Python.
Trail of Bits CEO Dan Guido said: "Codex lets our team do in one day what used to take weeks."
In plain terms = the two firms have already proven the "AI + security engineer" workflow. An acquisition would lock that partnership in permanently.
What might this deal cost?
The price has not been disclosed. According to The Information, OpenAI has previously paid as little as low hundreds of millions of dollars in equity when acquiring small startups, and sometimes even less.
Sources say discussions are ongoing, and the deal could still fall apart.
This means → even if it closes, it is likely an equity-for-team "acqui-hire," not a high-price asset grab.
What else is OpenAI doing in cybersecurity?
OpenAI recently hired Dali Rajic, a former executive at Google's cloud cybersecurity unit Wiz, as its Chief Revenue Officer.
Both OpenAI and Anthropic are accelerating development of AI tools purpose-built to identify software vulnerabilities. Under White House coordination, they have granted large enterprises access to advanced models but restricted these capabilities in public-facing versions to prevent misuse.
This reflects a larger signal: AI companies are turning "security capability" from a defensive cost into a revenue-generating product line — and whoever earns the open-source security community's trust first will own the entry point.
市场有风险，内容仅供研究参考，不构成投资建议。