TRAIL OF BITS

Institutional Archetype

THE AUDITOR IN ACQUISITION TALKS — Trail of Bits is the security firm the rest of the field borrows tools from: it audits code for a living, publishes what it builds, and lists “AI/ML evaluation” among its practice areas. In 2026 it began working with OpenAI on open-source patching with OpenAI’s models, and by October OpenAI was reported to be in talks to buy it. The file is open because of that sequence. An independent auditor that evaluates AI systems, works with one frontier lab, and may become part of it is the evaluator-capture question in a single company. Nothing has been announced. The position is the finding either way.

Mandate & Origin

Founded in 2012 “to publish security research and tooling to raise the bar for everyone,” it won three DARPA Cyber Fast Track awards in its first year and finished second among the Cyber Reasoning Systems at DARPA’s 2016 Cyber Grand Challenge. It maintains smart-contract tools the field “standardized on” (Slither, Echidna, Manticore) and lists six security domains “from smart contracts to post-quantum cryptography to AI/ML evaluation” (Trail of Bits).

Funding & Backers

A services firm paid by its clients. The About page lists government work for DARPA and ARPA-H, including a $1 million semifinal award in DARPA’s AI Cyber Challenge (AIxCC) and a “$3M second-place prize at DARPA AIxCC finals” at DEF CON 33 in 2025 (Trail of Bits). It has not published outside investors in the sources above, and this file asserts none.

Institutional Voice & Intent

Technical, tool-first, publicly argumentative when it thinks a claim is false. When Crown Sterling paid for a Black Hat 2019 sponsored talk claiming new cryptography, CEO Dan Guido “barracked the presentation, and was removed from the room by conference security” (The Register); Gizmodo reported he challenged the speaker over “potentially putting people in danger” (Gizmodo). The episode is in troll.fan’s charlatans file.

Position in the Apparatus

• Patch the Planet (from June 2026). Per The Information as relayed by PYMNTS, Trail of Bits staff “work on open-source projects, like the Python programming language, to uncover, review and repair bugs, with assistance from OpenAI Codex tools, including models designed for cybersecurity”; Guido, in OpenAI’s promotional video: “Codex enabled our team to ship things in a day that would have otherwise taken us weeks of time” (PYMNTS)
• The talks (October 13, 2026). OpenAI “is in preliminary discussions to acquire cybersecurity company Trail of Bits,” The Information reported, citing unnamed sources; no deal has been announced and no price has been reported (PYMNTS; Yahoo Finance).

Actions & Leadership Choices

CONDUCT: WATCH — INDEPENDENCE IN PLAY. No wrongdoing is alleged and none is implied. The record is three facts in sequence: an independent firm that sells AI/ML evaluation; a 2026 working partnership in which its engineers use one lab’s security models; and that lab’s reported move to buy it. If the deal closes, an auditor the field relies on becomes part of a company whose models it is positioned to evaluate. If it does not, the partnership remains. Either outcome belongs in this file, and the weekly subject watch will report it.

Reach Assessment

Institutional: Its tools are standard in smart-contract security, and its engineers maintain widely used open-source code. Memetic: Low; the firm’s reputation is technical, which is why its independence is worth something.

Sources: About — Trail of Bits; OpenAI Weighs Deal for One-Time Security Partner Trail of Bits — PYMNTS (Oct 14, 2026); Report: OpenAI Interested in Acquiring Trail of Bits — Yahoo Finance (Oct 14, 2026); Biz forked out $115k to tout time-AI crypto at Black Hat, now it sues organizers — The Register; Bizarre sponsored talk mocked — Gizmodo.