An OpenAI model found a hard-to-spot Ubuntu server bug in two hours. Now OpenAI is shipping ChatGPT Cyber
A hobbyist aimed GPT 5.6 Sol at code he had audited before and got a serious server-takeover bug back. OpenAI's answer is a new cyber model and a bigger defenders program. Defenders say it isn't enough.
DevIsDead Newsroom
Max Justicz, CTO and co-founder of Charge Robotics, hunts bugs as a hobby. He'd found a flaw in one Ubuntu-related codebase before, so he pointed an OpenAI model at the same code and asked for something at least as bad. Two hours later he had a severe vulnerability that could let attackers take over servers running Ubuntu, Tim Fernholz reports for TechCrunch.
The model was GPT 5.6 Sol, out since July, which he reached via Daybreak Blue, OpenAI's program that gives security defenders access to frontier models. "It's extremely convoluted and hard for a human to find, but it works!" Justicz said. He reported it to the Debian Project, which maintains the code and shipped a patch. There's no known evidence it was exploited.
OpenAI's answer
The same day, OpenAI announced ChatGPT Cyber, a security-focused model for Daybreak Red, the top tier of its program, aimed at offensive researchers who hunt for and develop exploits. OpenAI says the model already scanned the Linux kernel and prepared patches, turning up 948 potential issues, and found 81 new vulnerabilities in Firefox. It also announced a $1 billion initiative for security professionals in the program who protect critical infrastructure like power grids and water systems, and says it wants Daybreak to cover companies large and small, independent researchers and the people who maintain open-source projects.
Why defenders are nervous
Justicz's takeaway was blunt: expect a wave of wild bugs over the next few months, because pointing a strong model at unaudited code is currently a huge advantage. Finding several exploits cost him roughly $5,000 in subscriptions and tokens. That's cheap for an attacker.
Defenders have complaints. Justicz says Daybreak Blue was recently nerfed to be less useful for bug hunting, and that joining took little more than uploading a photo of his driver's license. Security professionals say limiting their access hurts while attackers run open-weight models with the guardrails stripped. And OpenAI says only thousands of professionals are in Daybreak, against a far larger pool of would-be attackers.
OpenAI researcher Eric Wallace says the company is putting a significant amount of frontier compute into finding and patching open-source bugs for free. For scale, though: OpenAI spent $1.2 million on the Linux bug hunt, against roughly $6 million in tokens spent chasing a famous fluid dynamics problem.
What to do about it
If you maintain anything exposed to the internet, assume someone is already pointing a model at your code. The cheapest defense is to do it first: run the same kind of model against your own repos, triage what comes back, and budget time for patches. The bug-finding got faster. The fixing didn't.
Scoreboard update: AI +1. A model finds a hard-to-spot Ubuntu server bug in two hours that a human might have missed.
Stay undead.
Comments 0