AI-Driven Vulnerability Discovery
Max Justicz, the chief technology officer and co-founder of the startup Charge Robotics, used an OpenAI model to find a severe vulnerability that could allow hackers to take control of servers running Ubuntu, a widely used open source Linux-based operating system.
Justicz found this issue using GPT 5.6 Sol, released in July, through the AI maker’s Daybreak Blue, a program that gives cybersecurity defenders access to frontier models.
Justicz reported that he aimed the model at the codebase with a prompt to find bugs similar to or worse than a previously fixed issue, and it returned the vulnerability in two hours.
He reported the issue to the Debian Project, which issued a patch. While there is no evidence of exploitation, the ease of discovery suggests that novice hackers may soon utilize AI models for sophisticated exploits.
Justicz noted that there is significant potential for discovering vulnerabilities in unaudited code by utilizing powerful AI models, warning that the industry should expect more exploits in the coming months.
OpenAI's Defensive Initiatives
OpenAI announced a new model, ChatGPT Cyber, available to users in the Daybreak Red program. The company reported that the model was used to scan the Linux kernel, finding 948 potential issues, and identified 81 novel vulnerabilities in the Firefox browser.
The company stated that its goal is to expand the Daybreak program to provide advanced security research tools to organizations, independent researchers, and open-source maintainers.
Cybersecurity defenders face a growing workload that often outstrips their resources. Justicz reported spending approximately $5,000 on subscriptions and tokens to identify his findings.
OpenAI has announced a $1 billion initiative to support cybersecurity professionals working on critical infrastructure, such as electrical grids and water systems.
Critiques of the Daybreak Program
The Daybreak program has faced criticism regarding its utility. Justicz noted that the lab appears to have restricted the capabilities of Daybreak Blue, potentially hindering security professionals while bad actors continue to deploy open-weight models with fewer guardrails.
OpenAI states that thousands of cybersecurity professionals are participating in the program, though this remains a small fraction compared to the number of potential bad actors.
Eric Wallace, a researcher at OpenAI, stated that the company is allocating significant frontier compute resources toward discovering and patching vulnerabilities in open-source codebases.
Critics point out that the $1.2 million cost of the Linux bug hunt is significantly lower than the $6 million the company invested in research for fluid dynamics.
As the window for securing critical digital infrastructure narrows, there is increasing pressure for frontier labs to prioritize security research with more urgency.
