OpenAI Unveils ChatGPT Cyber as Automated Bug Hunting Accelerates
OpenAI has introduced ChatGPT Cyber to Daybreak Red researchers after models surfaced hundreds of flaws in the Linux kernel, highlighting the growing race in automated vulnerability discovery.
When Max Justicz, the cofounder and chief technology officer of startup Charge Robotics, decided to examine a Debian-maintained codebase used in the Ubuntu operating system, he turned to an artificial intelligence model rather than a manual audit. Working through OpenAI's Daybreak Blue program with GPT 5.6 Sol, a model released in July, Justicz prompted the system with details of an older vulnerability he had previously identified and asked it to surface new flaws of equal or greater severity. Within two hours, the AI returned an intricate bug that could have permitted attackers to gain control over Ubuntu servers. Although the Debian Project has since patched the flaw and no active exploitation was observed, Justicz characterized the finding as "extremely convoluted and hard for a human to find."
Automated Vulnerability Discovery at Scale
OpenAI is now formalizing this capability with a dedicated model called ChatGPT Cyber. Designed specifically for security research, the model is being deployed to Daybreak Red, the lab's specialized access tier for offensive cybersecurity researchers engaged in vulnerability hunting and development.
The automated discovery numbers reported by OpenAI demonstrate the breadth of this tooling. Using ChatGPT Cyber, researchers audited the Linux kernel, identifying 948 potential issues and drafting patches to resolve them. A similar scan of the Firefox web browser uncovered 81 novel vulnerabilities. OpenAI stated that its objective is to "dramatically expand Daybreak, bringing advanced security research to organizations of every size, independent researchers, and open-source maintainers."
Eric Wallace, a researcher on OpenAI's technical staff, noted that the company is "allocating a significant amount of our frontier compute towards discovering and patching vulnerabilities in open source codebases, fully pro bono." However, resource allocation across frontier projects remains a point of comparison: the Linux vulnerability sweep cost $1.2 million, whereas OpenAI previously invested roughly $6 million in token spend toward finding a potential solution for a problem in fluid dynamics.
Defensive Tooling Versus Adversarial Reality
OpenAI has framed these releases around a narrow window of opportunity, urging defenders to harden digital infrastructure before sophisticated exploit-generation capabilities become widely accessible to malicious actors. To assist in that effort, the company announced a $1 billion initiative supporting Daybreak participants who defend critical infrastructure such as water systems and the electrical grid.
Yet security practitioners face structural hurdles. Daybreak currently includes only "thousands" of vetted professionals, whereas attackers can operate without terms of service or deploy open-weight models with abliterated guardrails. Justicz, who entered the program by uploading a driver's license and spent roughly $5,000 on subscriptions and tokens to locate multiple exploits, observed that Daybreak Blue appeared to have been recently "nerfed," reducing its efficacy for bug hunting. As Justicz warned, there remains "huge alpha in taking some code or binary someone has not audited yet and just aiming a powerful AI model at it," signaling that an influx of complex bugs could be unearthed in the coming months.
What it means for developers
For software engineers and open-source maintainers, the rise of AI-driven vulnerability hunting fundamentally changes code maintenance. Securing repositories now requires assuming that both white-hat researchers and automated attackers will point powerful models at unaudited codebases, uncovering deeply buried flaws in hours rather than months.
At the same time, maintaining open-source infrastructure risks becoming unsustainable if developers face an unmanageable stream of machine-generated vulnerability reports. Development teams will need to incorporate AI-assisted security reviews directly into continuous integration pipelines to identify weaknesses before release. For teams benchmarking different models for code analysis and testing, services like Apixo (https://apixoai.online) allow developers to try top AI models cheaply through one API. As automated audits become standard practice, engineering organizations must proactively evaluate their own software before outside parties exploit uncovered weaknesses.
Source: OpenAI released a new cybersecurity model. Is that enough? — TechCrunch AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
