Trail of Bits

Sources#

What it is#

Trail of Bits is a security research and auditing consultancy. In this vault it appears as a heavy user of Codex and as a publisher of first-hand accounts of agent-assisted security work, almost all of it from Patch the Planet, its joint campaign with OpenAI to find and fix bugs in widely used open-source software. Its posts promote its own methods and plugins and are co-branded with OpenAI's campaign, so its figures are case-study at best, and the launch claims are its own.

What it published#

How we use /goal to find bugs in Patch the Planet (How we use /goal to find bugs in Patch the Planet, 2026-07-28). Goal-prompt design rules (Loop Engineering), the aicov read-coverage tool, a Rust P-critical variant-analysis pipeline with a two-model false-positive gauntlet, and the vault's first bug-class mix from a production scaffold. None of it is memory corruption: a rustc soundness hole and a miscompilation patched in Rust 1.98, and two potential Keycloak SAML privilege escalations (LLM-Driven Vulnerability Research).
Your AI agent fixed the bug, but what else did it change? (Your AI agent fixed the bug, but what else did it change?, Naik & Morales, 2026-10-21). The firm reviewed its own merged work and found 21 regressions in 130+ merged Patch the Planet PRs, none of which broke a security protection. It released the patching-bugs and regression-hunt plugins (live-PoC evidence, strict schemas, a three-arm proof, an adjudication agent) and asked maintainers for THREAT_MODEL.md and PATCHING_GUIDELINES.md files (Proof-Gated Agent Patching (Patch the Planet's Regression Audit)).

It also appears as a measured object. trailofbits/skills is one of the five repositories in Shen & Hruschka's git-history study of skill maintenance (Human-Governed Skill Maintenance), with 74 skills, AI co-authorship trailers on most edits and the slowest edit cadence of the five (14.5-day median). The two plugins above ship in that repository.

Connections#

Proof-Gated Agent Patching (Patch the Planet's Regression Audit) — the regression audit of its own patches and the plugin design built from it
LLM-Driven Vulnerability Research — the bug-finding side of Patch the Planet: the bug-class mix and the variant-analysis pipeline
Loop Engineering — the goal-prompt rules its engineers converged on
Human-Governed Skill Maintenance — its skills repository as a measured maintenance history
Codex, OpenAI — the agent it works through and its campaign partner