Max Justicz, Chief Technology Officer and co-founder of Charge Robotics, used a model from OpenAI to discover a critical vulnerability; if exploited, hackers could use it to take control of servers running Ubuntu, a widely used open-source, Linux-based operating system.
Justicz has a hobbyist interest in cybersecurity and previously discovered vulnerabilities in the same codebase. He told TechCrunch that he found this issue using GPT 5.6 Sol, released by OpenAI in July, through the company’s Daybreak Blue project—a platform that enables cybersecurity defenders to leverage powerful state-of-the-art models.
“I just pointed ChatGPT at the same code and said, ‘I previously found a bug that was fixed years ago—help me find another bug that’s equally or more severe,’ and after two hours, it found this one,” Justicz said. “This vulnerability is extremely complex and would be very hard for a human to spot—but it’s real!”
He reported the issue to the Debian Project, responsible for maintaining the relevant software, which subsequently released a patch to fix the vulnerability. There is currently no known evidence that this vulnerability has been exploited. However, the fact that he discovered this issue so easily suggests that even novice hackers could use AI models to identify and exploit potential vulnerabilities—risks that may only represent the tip of the iceberg.
I can only imagine what people could achieve with more time and access to less restricted models. We should expect that in the coming months, some extremely wild vulnerabilities will be discovered and exploited,” Justicz wrote in a social media post discussing the finding. “This may be obvious to most here, but right now, taking any un-audited code or binary and handing it directly to a powerful AI model offers a significant advantage.”
OpenAI has clearly taken note of this. Today, the company announced it will provide its new cybersecurity-focused model, ChatGPT Cyber, to the highest-tier users in its Daybreak Red cybersecurity program. Daybreak Red enables offensive cybersecurity researchers to use vulnerability discovery and development tools.
Yesterday, OpenAI stated that the same model was used to scan the Linux kernel and prepare patches for vulnerabilities, uncovering 948 potential issues. OpenAI also discovered 81 "novel" vulnerabilities in the Firefox web browser.
This cutting-edge laboratory stated in a press release: “Our goal is to significantly expand Daybreak, bringing advanced security research to organizations of all sizes, independent researchers, and open-source maintainers.”
OpenAI has consistently emphasized that those protecting digital infrastructure have only a narrow window of time to act, as AI models will only become more skilled at hacking and more accessible. For cybersecurity defenders, this feels like a flood of new workloads being unleashed from cutting-edge labs, overwhelming their available resources. Justicz said he spent approximately $5,000 on subscriptions and tokens while searching for multiple vulnerabilities.
In addition to granting access to Daybreak’s model, OpenAI announced a $1 billion initiative to support cybersecurity professionals involved in the project and working on critical infrastructure such as power grids or water systems.
The Daybreak project itself has also faced criticism. Justicz noted that the cutting-edge lab has recently seemed to "weaken" Daybreak Blue, making it less useful for discovering vulnerabilities. On one hand, restricting access for potential malicious actors may be beneficial—Justicz said that when he joined the project, he simply uploaded a photo of his driver’s license. On the other hand, cybersecurity professionals say they are left handicapped if they cannot access cutting-edge tools, while malicious actors can deploy open-source weight models stripped of security safeguards.
Nevertheless, OpenAI stated that only "thousands" of cybersecurity professionals are involved in the Daybreak project, while the number of potential hackers is much larger.
It is still unclear whether Frontier Labs has allocated sufficient resources to address this issue. Eric Wallace, a researcher on OpenAI’s technical team, said: “We are currently dedicating a significant portion of our frontier computing power to discovering and patching vulnerabilities in open-source code repositories, entirely on a nonprofit basis.”
However, the cost of searching for Linux vulnerabilities was $1.2 million, significantly lower than the approximately $6 million in token expenditures the company invested in seeking a potential solution to a well-known fluid dynamics problem.
If the digital infrastructure the world relies on truly has only a narrow window for repair, then a greater sense of urgency may be needed.