Max Justicz, the chief technology officer and cofounder of Charge Robotics, used an OpenAI model to find a severe vulnerability that could allow hackers to take control of servers running Ubuntu, a widely-used open-source Linux based operating system.
Justicz told TechCrunch that he found the issue using GPT 5.6 Sol, released in July, through the AI maker’s Daybreak Blue programme. This tool gives cybersecurity defenders access to powerful frontier models. He had previously found a vulnerability in the same codebase as a hobbyist.
“I literally just aimed ChatGPT at the same body of code and said ‘I found this bug previously that was fixed several years ago, please find bugs as bad or worse,’ and it came back in two hours with this,” Justicz said. “It’s extremely convoluted and hard for a human to find, but it works!”
He reported the issue to the Debian Project, which maintains the software in question and issued a patch to fix the vulnerability. There has been no known evidence of exploitation. Still, the ease with which he found it suggests that we have only seen the tip of the iceberg when it comes to potential exploits that even novice hackers can utilise with the help of AI models.
“I can only imagine what one could do with more time and access to less neutered models. We should expect some extremely crazy bugs to be found and exploited over the next few months,” Justicz wrote in a social media thread discussing his finding. “This might be obvious to most folks here, but there is currently huge alpha in taking some code or binary someone has not audited yet and just aiming a powerful AI model at it.”
OpenAI appears to have noticed. Today, the AI giant announced a new model focused on cybersecurity, ChatGPT Cyber, would be made available to the highest-tier of users in the cybersecurity programme, Daybreak Red. This tier allows offensive cybersecurity researchers tools for vulnerability hunting and development. Yesterday, OpenAI said that the same model had been used to scan and prepare patches for vulnerabilities in the Linux kernel, finding 948 potential issues. OpenAI also found 81 “novel” vulnerabilities in Firefox, the web browser.
“Our goal is to dramatically expand Daybreak, bringing advanced security research to organizations of every size, independent researchers, and open-source maintainers,” the frontier lab said in a statement.
OpenAI has insisted that there is a narrow window of time for the people who safeguard digital infrastructure to take action before AI models become even better at hacking and easier to access. For cyber defenders, however, it can feel like the frontier labs have unleashed a mountain of new work that outstrips their resources. Justicz said that he personally spent about $5,000 on subscriptions and tokens to find several exploits.
Besides Daybreak’s model access, OpenAI has also announced a $1 billion initiative to support cybersecurity professionals in the programme who work on critical infrastructure like the electrical grid or water systems.
The Daybreak programme has its own critiques. Justicz notes that the frontier lab appears to have recently “nerfed” Daybreak Blue to make it less useful at finding vulnerabilities. On one hand, it may be good to limit access from potential bad actors — Justicz said he just uploaded a photo of his drivers’ license to join the programme. On the other, cybersecurity professionals say they have one hand tied if they cannot use frontier technology while bad actors can deploy open-weight models with abliterated guardrails.
Still, OpenAI says just “thousands” of cybersecurity professionals are participating in the Daybreak programme, versus a far larger number of potential hackers.
It’s unclear if frontier labs are devoting enough of their resources to this issue. Eric Wallace, a researcher on OpenAI’s technical staff, said that “we are now allocating a significant amount of our frontier compute towards discovering and patching vulnerabilities in open source codebases, fully pro bono.”
But the Linux bug hunt cost $1.2 million, which is significantly less than the approximate $6 million token spend the company invested in finding a potential solution to a famous problem of fluid dynamics.
If there is a narrow window of time to patch the digital infrastructure the world depends on, more urgency may be required.
