OpenAI proposed a coordinated process for responding to AI-assisted vulnerability discoveries on October 21, following critical PHP security updates. The company presented work with PHP, Calif and Wiz as an example of giving defenders time to prepare protections before disclosure.
The PHP Foundation confirms releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, alongside AI-assisted research and validation. It says people still make the decisions and work on every patch. Wiz describes its own research using several models. These accounts concern deliberately commissioned security work.
OpenAI’s proposal covers maintainer-led validation and repair, targeted advance notice, government coordination, downstream updates and public deployment guidance. The company is seeking feedback; it has not established a universally binding industry standard.
Participants also describe concrete protective steps. Cloudflare reports deployed firewall rules, while Google Cloud explains automatic updates for supported runtimes and required action for self-managed applications. Their guidance says mitigations do not replace the appropriate PHP update.
The PHP Foundation also identifies resource and decision-making problems behind the prolonged remediation, and disruptions to coordinated disclosure. OpenAI and Wiz warn that the same AI capabilities could help attackers. Their accounts do not establish universal protection or an unauthorized attack by the models involved.