OpenAI launches ChatGPT Cyber after researcher finds severe Ubuntu flaw with its model

OpenAI has released a cybersecurity-focused model called ChatGPT Cyber, arriving the same week that a part-time security researcher demonstrated how capable its existing models already are at offensive work. According to TechCrunch, he used an OpenAI model to uncover a serious flaw in Ubuntu server software in roughly two hours — a bug that could have let attackers seize control of machines running the widely deployed Linux distribution.

A two-hour bug hunt

Max Justicz, chief technology officer and cofounder of the robotics startup Charge Robotics, pursues security research as a hobby and had previously found a flaw in the same codebase. This time he pointed GPT 5.6 Sol, an OpenAI model released in July, at the code through Daybreak Blue, a program that gives defensive security researchers access to frontier models. He told the model he had found a bug there years earlier that was later fixed, and asked it to look for flaws of equal or greater severity. TechCrunch reports that it returned a working result within two hours — one Justicz described as so convoluted that a human would be unlikely to stumble on it.

He reported the issue to the Debian Project, which maintains the affected software and shipped a patch. There is no known evidence that anyone exploited the flaw before it was fixed. Justicz said he spent about $5,000 in total on subscriptions and tokens to find several exploits, and warned publicly that people should expect remarkable bugs to be found — and exploited — as researchers aim powerful models at code that nobody has audited yet.

ChatGPT Cyber and the Daybreak program

The same day TechCrunch published its report, OpenAI announced ChatGPT Cyber, a model built for cybersecurity work that will be offered to the highest tier of Daybreak Red, the arm of its program serving offensive researchers who hunt for and develop exploits. A day earlier, OpenAI said that same model had been used to scan the Linux kernel and prepare patches, surfacing 948 potential issues, and separately to find 81 previously unknown vulnerabilities in Firefox.

OpenAI also announced a $1 billion initiative to support program participants who work on critical infrastructure such as the electrical grid and water systems, and said in a statement that it wants to dramatically expand Daybreak to organizations of every size, independent researchers, and open-source maintainers.

An uneven playing field

The program has drawn criticism from the very people using it. Justicz told TechCrunch that OpenAI appears to have recently weakened Daybreak Blue, making it less useful for finding vulnerabilities. Enrollment, meanwhile, was light-touch — he said he joined simply by uploading a photo of his driver's license. Security professionals argue they are fighting with one hand tied if they cannot use frontier technology while attackers deploy open-weight models with guardrails stripped out.

OpenAI acknowledges the imbalance: it says only thousands of cybersecurity professionals participate in Daybreak, compared with a far larger pool of potential hackers. On resources, OpenAI staff researcher Eric Wallace said the company now devotes a significant share of its frontier compute, at no charge, to discovering and patching vulnerabilities in open-source codebases. But per TechCrunch, the Linux kernel effort cost roughly $1.2 million — considerably less than the approximately $6 million in tokens the company spent pursuing a solution to a well-known fluid dynamics problem.

Why it matters

The Ubuntu find is a concrete demonstration that frontier models can locate severe, exploitable flaws in core infrastructure quickly and cheaply — about two hours and a few thousand dollars in this case. That cuts both ways. Defenders and open-source maintainers gain a powerful auditing tool, while the cost of offensive discovery collapses for everyone else, including novices. OpenAI itself argues there is only a narrow window to harden the infrastructure the world depends on before models get better at hacking and easier to access. The figures TechCrunch reports — a few thousand vetted defenders, and a bug-hunting spend dwarfed by outlays on other research problems — raise the question of whether that stated urgency is being matched by actual resources.