OpenAI says an agent it calls Calif found a critical vulnerability in PHP using GPT-5.6 Sol as part of an initiative it calls Patch the Planet, and that Wiz independently discovered and reported both flaws. PHP maintainers led the fix and release, with Wiz, Cloudflare and others contributing research and coordination ahead of disclosure. OpenAI frames the episode as evidence that frontier models can find internet-scale security flaws before attackers do, a gap it calls the Defender's Window, and says it expects similar findings to increase sharply. It is publishing a five-stage response framework: validate and fix upstream, including adversarial testing with frontier models to look for ways around the patch and related variants; give distributors and service providers time to adapt fixes, test mitigations and write WAF rules; coordinate with government partners, which in this case meant the White House's Super Intelligence Force, ONCD, CISA and international counterparts; prepare updates across affected products; then publish guidance and support deployment. A PHP version checker is offered as a Codex skill.
Our takeThe claim worth testing is throughput, not the counterfactual of who would have found the bug first, which cannot be verified. What the write-up does show is that discovery is now cheap enough to outrun the patch-and-deploy path, so the coordination stages matter more than the find. Adversarial testing around a proposed patch is the strongest element of the framework. The weakest is the time-gap stage: it asks distributors to prepare protections but sets no deadline, which is where agent-speed discovery will keep outrunning human-speed release.