# GPT-5.5-Cyber built a zlib fuzzing lab in a day

DevFeed: [GPT-5.5-Cyber built a zlib fuzzing lab in a day](<https://devfeed.tech/articles/gpt-5-5-cyber-built-a-zlib-fuzzing-lab-in-a-day-7656.md>)

Original publisher: [Read original article](<https://blog.trailofbits.com/2026/07/02/field-reports-from-patch-the-planet/>)

Author: "Benjamin Samuels"

Published: 2026-07-02T11:00:00Z

Content type: article

Language: en

Sources: [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog.md>), [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog-2.md>)

Topics: [AI-assisted coding](<https://devfeed.tech/topics/ai-assisted-coding.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [AI Chat](<https://devfeed.tech/topics/ai-chat.md>)

Tags: [bugs](<https://devfeed.tech/tags/bugs.md>), [codex](<https://devfeed.tech/tags/codex.md>), [compression](<https://devfeed.tech/tags/compression.md>), [fuzzing](<https://devfeed.tech/tags/fuzzing.md>), [gpt](<https://devfeed.tech/tags/gpt.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [openai](<https://devfeed.tech/tags/openai.md>), [patch-the-planet](<https://devfeed.tech/tags/patch-the-planet.md>), [security](<https://devfeed.tech/tags/security.md>), [tooling](<https://devfeed.tech/tags/tooling.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Trail of Bits reports that GPT-5.5-Cyber built a fuzzing campaign for zlib in a day, using sanitizer and variant builds, harnesses, and seeds. The effort is part of Patch the Planet, which aims to find and patch security bugs in open-source projects with maintainers.

## Source excerpt

We're running Patch the Planet, an ongoing collaboration with OpenAI that pairs Trail of Bits engineers directly with more than 30 open-source projects. Its goal is to front-run a serious problem facing open-source maintainers: highly capable models like GPT-5.5-Cyber will soon create a firehose of bug reports, and OSS maintainers are already spread thin. Our plan is to point OpenAI's latest models at real codebases, find the security bugs first, work with maintainers to patch them, and find ways to decrease the burden on maintainers in the long run. We'll publish field reports like this one as the initiative progresses; follow along via the Patch the Planet tag. The expertise barrier that kept bespoke fuzzing campaigns out of reach for most attackers is gone. We watched GPT-5.5-Cyber build in a single day what would have taken weeks for a skilled security researcher: harnesses across a dozen entrypoints, sanitizer and variant builds, seeds, and multiple findings currently undergoing coordinated disclosure. This particular instance focused on zlib, a widely used data format and lossless data compression software library. We pointed GPT-5.5-Cyber at the library and drove it through Codex with the /goal command, asking it to find a specific class of bugs that are critically dangerous in compression libraries. We'll publish the full harness and findings for inspection once the vulnerabilities are patched and a new release is cut. The lab GPT-5.5-Cyber built in a day We didn't tell the model how to find these bugs. The obvious first move is to read the source code, but zlib has been reviewed so thoroughly that there's little left to find that way. GPT-5.5-Cyber worked that out for itself, judged static review to be a poor use of tokens, and decided the higher value path was to build fuzz tooling to dynamically test the code. Earlier models given the same goal tend to read the code and flag whatever looks suspicious, ultimately leading to mediocre outcomes. We believe th