Originally published at webofmike.com on 2026-10-27. The demo repo and every command in it were run before publishing.

OpenAI's "Patch the Planet" initiative spent two months coordinating a fix for two critical PHP flaws, collectively called PHP2Shell, before publishing the writeup on October 21. Security firm Calif found one using GPT-5.6 Sol; Wiz independently found and reported both. The same post commits $1 billion in subsidized Daybreak access through a program called Daybreak for Frontline Defenders, aimed at under-resourced defenders. The HN thread reacting to all of it pulled 265 points and 183 comments in a day, and almost none of it answers the one question OpenAI's own post actually asks: if this becomes agents continuously scanning the internet for known vulnerabilities, what governs them while they do it.

That's not a rhetorical gap I'm reading into the post.…