OpenAI has introduced ChatGPT Cyber, a model built for cybersecurity work, after recent tests showed frontier systems finding serious flaws in widely used open-source software. The case in point was a severe Ubuntu server vulnerability found by Charge Robotics CTO Max Justicz with GPT-5.6 Sol in about two hours. OpenAI also reported 948 potential issues in the Linux kernel and 81 novel flaws in Firefox. The development matters because defenders now face faster discovery of bugs with limited staff and budgets.
How the Ubuntu flaw and ChatGPT Cyber emerged
Justicz, a cofounder of Charge Robotics with a hobbyist interest in security, targeted code he knew well. He had previously found a vulnerability in the same codebase that was fixed several years ago. Using access through Daybreak Blue, a program for cybersecurity defenders, he asked ChatGPT to look for bugs as bad or worse. The model returned a working exploit path after two hours of analysis. He described the flaw as extremely convoluted and difficult for a person to spot.
ChatGPT Cyber is positioned differently from the defender-oriented access Justicz used. OpenAI said the new model will be available to the highest tier of users in Daybreak Red, a track for offensive security researchers working on vulnerability hunting and development. The company disclosed that the same underlying model scanned the Linux kernel and helped prepare patches for the issues found. It also identified 81 previously unknown vulnerabilities in the Firefox browser. No evidence of exploitation of the Ubuntu issue has been reported.
The disclosure process followed established open-source practice. Justicz reported the Ubuntu-related issue to the Debian Project, which maintains the software and issued a patch. OpenAI framed its work as pro bono scanning of open-source codebases using frontier compute. Researcher Eric Wallace said the company is now directing a significant amount of frontier compute toward finding and patching such flaws. The Linux bug hunt cost 1.2 million dollars in compute, less than the approximate 6 million dollar token spend on a fluid dynamics research problem.
What this means for companies relying on software
For businesses, the practical shift is the speed and cost of vulnerability discovery. Justicz said he spent about 5,000 dollars on subscriptions and tokens to find several exploits. That price point puts capable code auditing within reach of small technology firms, suppliers, and independent researchers, not only large security vendors. Larger organizations running Ubuntu, Debian-based systems, Linux servers, or Firefox in their fleet gain earlier patches but also face more urgent testing and deployment cycles.
The limits sit in access, verification, and misuse risk. Daybreak Blue was designed for defenders, while Daybreak Red supports offensive research, and Justicz said Blue recently became less effective at finding flaws. Enrollment controls appear light: he said he joined by uploading a photo of a driver license. Security practitioners warn that attackers can use open-weight models with removed safeguards, while defenders number only in the thousands inside Daybreak. OpenAI also announced a 1 billion dollar initiative for program participants working on critical infrastructure such as power grids and water systems.
The marker to watch is whether expanded Daybreak access and the 1 billion dollar support program translate into patched flaws in critical open-source projects over the next few months. If patch volumes rise across Linux, Debian packages, and browsers without corresponding exploitation reports, the defender window will look real. If novel exploits appear first, companies will need faster asset inventories and patch discipline.
