OpenAI Unveils ChatGPT Cyber After Finding 948 Linux Issues and 81 Firefox Flaws
OpenAI launches ChatGPT Cyber after AI found 948 Linux issues and 81 Firefox flaws, but limited access and a widening attacker gap raise doubts about defense.
Summary
Charge Robotics co-founder and CTO Max Justicz used OpenAI’s GPT 5.6 Sol, released in July, through the defender-focused Daybreak Blue program to uncover within two hours a severe flaw that could let attackers seize Ubuntu servers. He asked ChatGPT to find bugs as serious as one he had previously discovered in the same codebase. Debian patched the software, and no exploitation is known. Justicz, a cybersecurity hobbyist, spent about $5,000 on subscriptions and tokens while finding several exploits, showing how powerful models can expose difficult flaws to novices.
On November 5, 2026, OpenAI announced ChatGPT Cyber for Daybreak Red’s highest tier, giving offensive researchers advanced vulnerability hunting and development tools. On November 4, OpenAI said the model identified 948 potential Linux kernel issues and 81 novel Firefox vulnerabilities. It plans to expand Daybreak to organizations of all sizes, independent researchers and open-source maintainers, and has committed $1 billion to professionals protecting critical infrastructure such as electrical grids and water systems.
OpenAI says defenders have a narrow window before hacking models improve and spread, yet Daybreak has only thousands of cybersecurity professionals against far more potential hackers. Justicz says Daybreak Blue appears recently weakened, although enrollment required only a driver’s license photo; defenders argue restrictions handicap them while adversaries can use open-weight models with removed guardrails. OpenAI researcher Eric Wallace says significant frontier compute now finds and patches open-source flaws free, but the Linux hunt cost $1.2 million, versus about $6 million in tokens for a fluid dynamics problem, intensifying doubts about urgency and resource allocation.
Positives
- GPT 5.6 Sol found a severe Ubuntu server vulnerability within two hours after Max Justicz supplied a previous bug as a benchmark.
- Debian issued a patch for the vulnerability, and no exploitation has been detected.
- ChatGPT Cyber identified 948 potential Linux kernel issues and 81 novel Firefox vulnerabilities.
- OpenAI committed $1 billion to cybersecurity professionals protecting critical infrastructure, including electrical grids and water systems.
- Significant frontier compute is now being allocated free to finding and patching vulnerabilities in open-source code.
Risks & concerns
- The Ubuntu flaw could have allowed hackers to take control of affected servers.
- Max Justicz spent about $5,000 on subscriptions and tokens while finding several exploits, illustrating the resource burden facing independent defenders.
- Daybreak has only thousands of cybersecurity participants, far fewer than the potential hackers who could deploy AI tools.
- Daybreak Blue appears less capable after recent restrictions, while attackers can use open-weight models with removed guardrails.
- The Linux hunt received $1.2 million, compared with about $6 million in tokens spent on a fluid dynamics problem.
- Daybreak enrollment required Justicz to upload only a driver’s license photo, highlighting tension between access controls and powerful offensive capabilities.