OpenAI’s cyber model meets a widening defender gap
A researcher says he used an OpenAI model to uncover a severe flaw in software used by Ubuntu servers in about two hours. Debian issued a patch, and there is no known evidence the vulnerability was exploited—but the discovery has sharpened questions about whether defenders can keep pace with AI-assisted hacking.
Max Justicz, co-founder and chief technology officer of Charge Robotics, told TechCrunch he used GPT 5.6 Sol through OpenAI’s Daybreak Blue program to search code maintained by the Debian Project. He asked the model to find bugs as serious as one he had previously identified in the same codebase. The flaw could have allowed an attacker to take control of affected servers. Debian has patched it.
OpenAI has announced ChatGPT Cyber, a cybersecurity-focused model for the highest tier of its Daybreak Red program, which gives offensive security researchers tools for vulnerability research. The company said the model had also helped scan the Linux kernel, identifying 948 potential issues, and found 81 “novel” vulnerabilities in Firefox. OpenAI says it wants to expand Daybreak access to organizations, independent researchers and open-source maintainers.
The effort comes with a resource problem. Justicz said he spent about $5,000 on subscriptions and tokens to find several exploits. OpenAI’s Linux kernel bug hunt cost $1.2 million, compared with about $6 million in tokens the company spent pursuing a possible solution to a fluid-dynamics problem. OpenAI researcher Eric Wallace said the company is allocating a significant amount of frontier computing power to finding and patching open-source vulnerabilities, pro bono.
Access restrictions are also contested. Justicz said Daybreak Blue appears to have been “nerfed,” potentially making it less useful for vulnerability discovery. He said he provided a photo of his driver’s license to join the program. Limiting access could deter malicious users, but defenders worry they may be constrained while attackers can use open-weight models with weakened safeguards. OpenAI says “thousands” of cybersecurity professionals are in Daybreak, far fewer than the potential number of hackers. The company has also announced a $1 billion initiative to support program participants working on critical infrastructure, including power grids and water systems.
Comments (0)
No comments yet. Be the first!