Max Justicz, CTO and co-founder of Charge Robotics, used an OpenAI model to find a severe vulnerability that could let hackers take control of servers running Ubuntu, a widely used open source Linux-based operating system. Justicz, a hobbyist security researcher who previously found a vulnerability in the same codebase, told TechCrunch he found the issue using GPT 5.6 Sol, released in July, through OpenAI‘s Daybreak Blue program for defenders. He said he simply aimed ChatGPT at the code, pointed to the bug he had found years ago, and asked it to find bugs as bad or worse. The model came back in two hours with a highly convoluted exploit. He reported the issue to the Debian Project, which maintains the software and issued a patch; no known exploitation has occurred.

The ease of the finding is a concrete example of how frontier models can multiply the capabilities of amateur hackers. Justicz wrote that with more time and access to less-neutered models, people should expect some extremely crazy bugs to be found and exploited over the next few months, and that there is currently huge alpha in aiming a powerful AI model at unaudited code or binaries.

OpenAI has noticed. The company announced ChatGPT Cyber, a new model focused on cybersecurity, for the highest tier of users in Daybreak Red, its program for offensive security researchers. OpenAI said the same model scanned the Linux kernel and prepared patches for 948 potential issues, and it found 81 novel vulnerabilities in Firefox. OpenAI‘s stated goal is to dramatically expand Daybreak to organizations of every size, independent researchers, and open-source maintainers. The lab has insisted that there is a narrow window of time for defenders to act before AI models become even better at hacking and easier to access.

Defenders, however, say the labs have unleashed a mountain of new work that outstrips their resources. Justicz spent about $5,000 on subscriptions and tokens to find several exploits. OpenAI appears to have recently nerfed Daybreak Blue, making it less useful for vulnerability discovery; Justicz noted that he uploaded a photo of his driver’s license to join the program. That may limit access by bad actors, but cybersecurity professionals argue they have one hand tied if they cannot use frontier technology while attackers can deploy open-weight models with abliterated guardrails. OpenAI says only thousands of professionals are in Daybreak, versus a far larger number of potential hackers.

OpenAI is spending real money on defense — a $1 billion initiative to support cybersecurity professionals working on critical infrastructure, and technical staff researcher Eric Wallace says a significant amount of frontier compute now goes toward discovering and patching open-source vulnerabilities pro bono. But the Linux bug hunt cost $1.2 million, considerably less than the roughly $6 million token spend on a fluid dynamics problem. The article closes by questioning whether that level of urgency is enough to patch the digital infrastructure the world depends on.