Billing Support — October 22, 2026

Finding a vulnerability is not the same as securing users. Once AI accelerates discovery, the hard part shifts downstream: reproducing reports, rejecting false positives, designing compatible fixes, coordinating releases, and confirming that deployed systems are actually protected. OpenAI’s October 21–22, 2026 PHP2Shell disclosure illustrates why vulnerability research needs an operational pipeline, not merely a capable model.

Discovery Must Start With a Bounded Task

A useful AI-assisted security engagement begins by constraining the problem. Researchers and maintainers define the codebase, components, threat assumptions, supported versions, and classes of behavior worth investigating. Without those boundaries, a model can produce a large queue of speculative findings that consumes more maintainer time than it saves.

OpenAI’s Patch the Planet program was designed around this bottleneck.…