Max Justicz, chief technology officer and co‑founder of Charge Robotics, used an OpenAI model to discover a serious vulnerability that could have allowed attackers to take control of servers running Ubuntu, a widely used Linux distribution. Justicz pursues cybersecurity as a hobbyist and previously found a flaw in the same codebase.
According to Justicz, he found the issue with GPT 5.6 Sol, released in July, accessed through OpenAI’s Daybreak Blue program. Daybreak Blue is the tier that provides defenders with access to frontier models for security research.
"I literally just aimed ChatGPT at the same body of code and said ‘I found this bug previously that was fixed several years ago, please find bugs as bad or worse,’ and it came back in two hours with this,” Justicz said. He added the vulnerability was extremely convoluted and hard for a human to find, yet the model produced a workable exploit.
Reporting and patching; no known exploitation
Justicz reported the vulnerability to the Debian Project, which maintains the affected software. Debian released a patch to fix the issue. There is no known evidence that the flaw was ever exploited in the wild.
Still, the ease with which Justicz was able to locate the bug suggests many more exploitable problems could exist and be found by people with limited expertise if aided by AI. In a social post, he warned that with more time or access to less‑restricted models, "we should expect some extremely crazy bugs to be found and exploited over the next few months."
OpenAI’s response: ChatGPT Cyber and Daybreak Red
OpenAI announced a new model tailored for cybersecurity, ChatGPT Cyber, which will be available to the highest tier of the Daybreak program, Daybreak Red. Daybreak Red gives offensive security researchers tools for vulnerability hunting and exploit development.
OpenAI also said the same model was used to scan and prepare patches for open‑source projects: the company reported finding 948 potential issues in the Linux kernel and identifying 81 "novel" vulnerabilities in Mozilla Firefox.
"Our goal is to dramatically expand Daybreak, bringing advanced security research to organizations of every size, independent researchers, and open‑source maintainers," the company said.
Costs, capacity, and criticism
OpenAI has argued there is a narrow window for defenders to act before models become even better at hacking and more widely accessible. Defenders, however, say the surge of work generated by frontier labs exceeds their resources. Justicz said he personally spent about $5,000 on subscriptions and tokens to find several exploits.
OpenAI has also announced a $1 billion initiative to support cybersecurity professionals in the Daybreak program who work on critical infrastructure such as the electrical grid and water systems.
Daybreak has attracted criticism. Justicz said OpenAI appears to have recently "nerfed" Daybreak Blue to make it less effective at finding vulnerabilities. That can reduce the risk of misuse — Justicz noted that he simply uploaded a photo of his driver’s license to join the program — but defenders worry they are hamstrung if they cannot use frontier capabilities while attackers can run open‑weight models with little to no guardrails.
OpenAI says "thousands" of cybersecurity professionals participate in Daybreak, compared with a much larger pool of potential attackers.
Commitment vs. scale
Eric Wallace, a researcher on OpenAI’s technical staff, said the company is "now allocating a significant amount of our frontier compute towards discovering and patching vulnerabilities in open source codebases, fully pro bono."
However, the Linux bug‑hunting effort reportedly cost $1.2 million, substantially less than the roughly $6 million token spend OpenAI invested on a separate computational effort to address a well‑known fluid dynamics problem.
If there truly is a limited time to patch the infrastructure that modern systems rely on, defenders and the frontier labs may need to accelerate efforts and devote more resources to finding and fixing vulnerabilities before they can be exploited at scale.
