GPT-5.6 Sol helped find a PHP flaw, but the response depended on people and patches

OpenAI says Calif identified a critical flaw in PHP using GPT-5.6 Sol during its Patch the Planet initiative. Wiz independently discovered and reported both vulnerabilities, and PHP maintainers led the fixes and release. That distinction matters: the announcement describes a model-assisted research effort, not a model autonomously finding and resolving a security problem. OpenAI’s account is the primary source for the Sol claim; TechCrunch also reports that Calif worked with OpenAI and that Wiz used AI in its separate research.

The public disclosure came after a longer period of research and coordination. OpenAI says it led a coalition of maintainers, researchers, and security providers over the two months before its October 21 account. The Associated Press reports that the PHP Foundation said the vulnerabilities had been known since at least 2024, but that progress on a fix stalled because earlier approaches had drawbacks and the project lacked resources. This history makes the useful story less about a single model result and more about getting a difficult finding through validation, remediation, and disclosure.

The reports describe different parts of the process, so the claims should not be collapsed into “AI found the bugs.” OpenAI attributes Calif’s critical flaw identification to GPT-5.6 Sol and says Wiz independently found both vulnerabilities. AP reports that humans first discovered the vulnerabilities, while AI tools helped identify how they could be exploited and supported testing and validation of fixes. The available reporting does not establish that the model alone discovered both vulnerabilities, nor does it provide a reproducible evaluation showing how often this workflow finds real flaws compared with other methods.

For technical teams, the immediate implication is operational: finding a flaw only creates value if maintainers can produce a safe fix and operators can deploy it. AP reports that the vulnerabilities could enable unauthenticated access and that some organizations faced disruption while applying updates. OpenAI directs PHP users to maintainer and provider guidance and says its coordination effort included preparing protections before disclosure. The episode shows a plausible defensive use for capable models, but it also shows the limits: the vulnerability was long-lived, the fix depended on maintainers and partners, and OpenAI warns that similar capabilities can help attackers develop exploits.