OpenAI rolls out ChatGPT Cyber as AI vulnerability hunting expands
OpenAI expands Daybreak access for cyber research
OpenAI has introduced ChatGPT Cyber, a cybersecurity-focused model for the highest tier of its Daybreak programme, Daybreak Red. The company said the model was used to scan the Linux kernel and prepare patches for vulnerabilities, identifying 948 potential issues, and to find 81 “novel” vulnerabilities in the Firefox browser.
The announcement follows an example of how quickly frontier models can support software auditing. Max Justicz, chief technology officer and cofounder of Charge Robotics, said he used GPT-5.6 Sol through OpenAI’s Daybreak Blue programme to locate a severe vulnerability in code associated with Ubuntu servers. He said the model produced the finding in two hours after he asked it to seek bugs at least as serious as one he had found in the same codebase years earlier.
Justicz reported the issue to the Debian Project, which maintains the software in question. Debian issued a patch, and there is no known evidence that the vulnerability was exploited.
Discovery capacity raises the pressure on maintainers
The results illustrate both the defensive value and the operational burden of AI-assisted vulnerability research. A model can examine code that has not been fully audited and surface potential flaws rapidly, but each result still requires validation, prioritisation, remediation and coordinated disclosure.
OpenAI says it wants to broaden Daybreak to organizations of every size, independent researchers and open-source maintainers. Its approach sits alongside new cyber-AI controls from Google, Anthropic and OpenAI on new cyber-AI controls from Google, Anthropic and OpenAI, where access and safeguards remain central to the use of advanced models for security work.
Access is contested. Justicz said Daybreak Blue had recently become less useful for vulnerability discovery, an apparent limitation that may reduce misuse by bad actors. At the same time, he argued that security professionals can be constrained if frontier systems are restricted while attackers can use open-weight models with removed guardrails. He also said he joined the programme by uploading a photograph of his driver’s licence.
Funding and capacity remain central questions
OpenAI said only “thousands” of cybersecurity professionals participate in Daybreak, compared with a much larger potential population of hackers. The company has also announced a $1 billion initiative to support Daybreak cybersecurity professionals working on critical infrastructure, including electrical grids and water systems.
Eric Wallace, a researcher on OpenAI’s technical staff, said the company is allocating a significant amount of frontier compute to finding and patching vulnerabilities in open-source codebases on a pro bono basis. OpenAI’s Linux effort cost $1.2 million, while Justicz said he spent about $5,000 on subscriptions and tokens to find several exploits.
For businesses that rely on open-source infrastructure, the immediate implication is to plan for a larger flow of AI-assisted reports: maintain clear intake and disclosure routes, assign people to validate findings, and fund patch deployment rather than treating automated discovery as a complete security solution.