OpenAI widens AI bug-hunting access as the risk grows too

OpenAI said this week that ChatGPT Cyber, a model built specifically for security work, will go to the highest tier of Daybreak, the company’s program for cybersecurity defenders — Daybreak Red, aimed at offensive researchers who hunt for and build fixes for vulnerabilities. A day earlier, the company said the same model had already scanned the Linux kernel and drafted patches covering 948 possible issues, plus 81 vulnerabilities it called “novel” in the Firefox browser.

The release follows a smaller, independent demonstration of the same idea. Max Justicz, who co-founded and serves as CTO of the robotics startup Charge Robotics, aimed an OpenAI model — GPT 5.6 Sol, launched in July — at Ubuntu’s codebase through Daybreak Blue, the program’s defender-access tier. He told TechCrunch the model surfaced, within two hours, a severe bug that could let an attacker seize control of servers running the widely used open-source operating system. “It’s extremely convoluted and hard for a human to find, but it works!” Justicz said. He reported the flaw to the Debian Project, which maintains the software and has since shipped a fix; there’s no known evidence anyone exploited it beforehand.

Justicz estimated he spent roughly $5,000 on subscriptions and compute to turn up several bugs this way — a modest outlay next to OpenAI’s own numbers: the Linux kernel sweep ran about $1.2 million, well below the roughly $6 million in tokens the company previously spent chasing a fluid-dynamics research problem. OpenAI is also backing the push with a $1 billion fund for security professionals protecting infrastructure like power grids and water systems.

Access to Daybreak isn’t frictionless, but the gatekeeping may not be doing much. Justicz says OpenAI recently scaled back what Daybreak Blue can do, even though joining the program required nothing more than uploading a photo of his driver’s license. Cybersecurity professionals argue that trade-off cuts the wrong way: restricted access ties their hands with frontier tools while attackers can still reach for open-weight models with the safety guardrails stripped out. OpenAI puts Daybreak’s user base in the “thousands” — a fraction of the hackers it’s up against. Researcher Eric Wallace said the company is now steering a meaningful share of its frontier compute toward patching open-source code for free.

Why it matters

If a side-project hobbyist can turn a frontier model into a working exploit in two hours, the defenders racing to patch first — not the labs releasing the models — are the ones running out of time.