OpenAI is in early-stage talks to acquire New York cybersecurity firm Trail of Bits, according to The Information, a move that would give the AI developer deeper in-house expertise in software assurance, cryptography and blockchain security as it expands its cybersecurity business.
Neither OpenAI nor Trail of Bits has publicly confirmed the discussions, and the report did not disclose a potential valuation or transaction structure. The talks remain preliminary, according to The Information, leaving open whether they will result in a deal.
Trail of Bits would bring a specialized security team whose work spans low-level systems, application security, cryptographic engineering and smart-contract audits. For OpenAI, the acquisition could connect its AI models with engineers who regularly validate vulnerabilities, reproduce software failures, develop patches and work directly with open-source maintainers.
A security firm with deep blockchain ties
Founded in 2012 by three security researchers, Trail of Bits has roughly 40 employees. The company is especially familiar to blockchain developers through audits and security reviews involving projects including Uniswap, Aave, Worldcoin and Arbitrum.
Its open-source tools have also become fixtures in smart-contract development. Slither analyzes Solidity code for common security weaknesses, while Echidna is used for property-based testing, a process that tests whether code continues to satisfy defined safety rules under a wide range of inputs. Manticore supports symbolic execution, a technique for exploring many possible paths through a program rather than testing only a small set of manually chosen scenarios.
Such tools address a persistent problem in decentralized finance and token infrastructure: smart contracts often manage large pools of assets, yet deployed code can be difficult or impossible to alter quickly after a flaw is discovered. Automated analysis can identify potential problems early, but experienced reviewers are often needed to determine whether a finding is exploitable and whether a proposed fix creates new risks.
Trail of Bits’ client and research history extends beyond crypto. The firm has participated in programs run by the U.S. Defense Advanced Research Projects Agency, or DARPA, and performed strongly in the Cyber Grand Challenge, a DARPA competition centered on automated vulnerability discovery and remediation. It has also participated in the AI Cyber Challenge, which explores how AI can help defend critical software.
Patch the Planet tested AI-assisted security work
OpenAI and Trail of Bits already collaborated in June on “Patch the Planet,” an initiative under OpenAI’s Daybreak program. The project offered a practical test of a model-driven security workflow: OpenAI models scanned open-source software for possible issues, while Trail of Bits engineers evaluated the findings and handled the work required to turn valid discoveries into fixes.
According to Trail of Bits, the first week of the effort covered 19 open-source projects, including cURL, Python, Go, pyca/cryptography, Sigstore, aiohttp and NATS. The company said the work produced hundreds of findings, 64 pull requests and 51 reported issues. At the time of its announcement, 37 proposed patches had been merged.
The division of labor is relevant to the reported acquisition discussions. Language models can search large codebases and generate potential fixes rapidly, but security remediation depends on more than locating suspicious code. Maintainers must assess whether an issue is real, understand the consequences of a change, test compatibility and decide whether it fits a project’s development priorities.
Tracking data from around mid-September showed that roughly 68% of 186 Patch the Planet pull requests with recorded outcomes had been merged by project maintainers. Most accepted changes reportedly required little or no security-related alteration from the original proposal. Pull requests that did not merge were more often closed because work elsewhere had superseded them or because they did not fit a project’s scope, rather than because reviewers identified technical flaws.
That record suggests AI-assisted vulnerability hunting can be useful when paired with engineers capable of narrowing, validating and maintaining the output. It does not remove the need for independent review, particularly in blockchain systems where a flawed patch can affect applications, wallets and assets connected to a shared contract or protocol.
Security acquisitions have reached crypto infrastructure
A possible purchase of Trail of Bits would fit an established pattern in which large financial and data companies buy specialist teams to build security and compliance capabilities more directly into their operations.
Mastercard acquired blockchain analytics provider CipherTrace in 2021. CipherTrace supplied anti-money-laundering and blockchain tracing products used by financial institutions, exchanges and public-sector bodies. The acquisition gave Mastercard a position in infrastructure designed to examine transactions across public blockchains.
PwC Switzerland acquired ChainSecurity in 2020, bringing an ETH Zurich spinout focused on smart-contract auditing and formal verification into its technology-risk offerings. Formal verification uses mathematical methods to test whether software conforms to specified rules, making it particularly relevant for contracts handling automated financial functions.
More recently, S&P Global announced an agreement in September to acquire OpenZeppelin, the developer of widely used open-source smart-contract libraries and a provider of security reviews. S&P Global said OpenZeppelin would continue operating independently while retaining its brand and principal leadership.
The reported OpenAI talks place AI cybersecurity alongside that consolidation trend, though Trail of Bits’ engineering culture and open-source tooling would create a different integration challenge from acquiring a conventional software product. Its value lies partly in the credibility of its independent technical assessments and the community use of its tools.
For blockchain teams, the immediate issue is unlikely to be whether Trail of Bits’ tools disappear. Any transaction, if completed, would need to clarify how the firm’s audit practice, client work and open-source projects would operate under OpenAI. Those details would determine whether the deal primarily expands OpenAI’s internal cyber capabilities or also changes how one of the sector’s most recognized security firms serves outside developers.
For deeper context on AI, security, and crypto, explore our guide on how AI complements blockchain in modern ecosystems.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
