Max Justicz, chief technology officer and co-founder of startup Charge Robotics, used OpenAI models to discover a serious vulnerability that, if exploited, could allow hackers to take control of servers running Ubuntu, a widely used open-source Linux-based operating system.
Justicz, who has a hobby in cybersecurity and has previously discovered vulnerabilities in the same codebase, told TechCrunch that he discovered the issue using GPT 5.6 Sol, released in July through AI maker Daybreak Blue. This issue is a program that provides cybersecurity defenders with access to a powerful frontier model.
“I literally just pointed ChatGPT at the same body of code and said, ‘I’ve found this bug before that was fixed a few years ago. Find me a bug that’s worse or worse,’ and it came back within two hours,” Justicz said. “It’s very complex and difficult for humans to find, but it works.”
He reported the issue to the Debian project, which maintains the software in question, and issued a patch to fix the vulnerability. There is no known evidence of exploitation. Still, the ease with which he found it suggests we’ve only seen the tip of the iceberg when it comes to potential exploits available to even novice hackers with the help of AI models.
“I can only imagine what could be done if we had more time and access to less crippled models. You should expect to see some really crazy bugs discovered and exploited in the coming months,” Justici wrote in a social media thread discussing his findings. “This may be obvious to most people here, but right now there’s huge alpha in just taking code or binaries that someone hasn’t yet audited and applying a powerful AI model to it.”
OpenAI seems to have noticed. Today, the AI giant announced that a new cybersecurity-focused model, ChatGPT Cyber, will be available to users in the top tier of its cybersecurity program, Daybreak Red. This makes tools available to offensive cybersecurity researchers for vulnerability exploration and development. Yesterday, OpenAI announced that it used the same model to scan for and patch Linux kernel vulnerabilities and discovered 948 potential issues. OpenAI also discovered 81 “new” vulnerabilities in the Firefox web browser.
“Our goal is to dramatically scale Daybreak and bring advanced security research to organizations of all sizes, independent researchers, and open source maintainers,” Frontier Labs said in a statement.
OpenAI argues that until AI models become more hackable and accessible, those protecting digital infrastructure have limited time to act. But for cyber defenders, it may feel like Frontier Labs has unleashed a slew of new work beyond their resources. Justicz said he personally spent about $5,000 on subscriptions and tokens to find some exploits.
In addition to Daybreak’s model access, OpenAI also announced a $1 billion commitment to programmatically support cybersecurity professionals working on critical infrastructure such as power grids and water systems.
The Daybreak program has its own criticisms. Justicz points out that Frontier Labs recently “nerfed” Daybreak Blue to make it less useful for finding vulnerabilities. On the other hand, limiting access from potential bad actors may be a good thing. Justicz said he just uploaded his driver’s license photo to participate in the program. Cybersecurity experts, meanwhile, argue that the inability to use cutting-edge technology leaves one hand tied, while bad actors can deploy an open-weight model with broken guardrails.
Still, OpenAI says there are only “a few thousand” cybersecurity professionals participating in the Daybreak program, and the number of potential hackers is much larger.
It is unclear whether Frontier Labs is devoting sufficient resources to this issue. “We are currently allocating a significant amount of our frontier computing to finding and patching vulnerabilities in open source code bases, completely free of charge,” said Eric Wallace, a researcher on OpenAI’s technical staff.
But the Linux bug hunt cost $1.2 million, significantly less than the roughly $6 million in token spending the company invested to find a potential solution to a famous problem in fluid mechanics.
It can be even more urgent when time is limited to patch the digital infrastructure the world depends on.
If you make a purchase through links in our articles, we may earn a small commission. This does not affect editorial independence.
