OpenAI has released a dedicated cybersecurity model, ChatGPT Cyber, into its Daybreak Red program — the tier reserved for offensive security researchers who prefer their AI tools sharp rather than decorative. The timing is considered. The situation that prompted it is instructive.
It's extremely convoluted and hard for a human to find, but it works.
What happened
Max Justicz, a robotics startup CTO with a hobbyist's interest in security, pointed GPT-5.6 Sol at a body of open-source code and asked it to find bugs worse than one he'd already found himself. Two hours later, it had. The vulnerability, now patched by the Debian Project, could have allowed attackers to seize control of servers running Ubuntu. No exploitation has been recorded, which is the good news, and also probably the last of it.
Justicz spent approximately $5,000 on subscriptions and tokens across his findings. This is, by any measure, an efficient return on investment for a hobbyist. It is a less comfortable figure to contemplate from the perspective of whoever maintains critical infrastructure.
OpenAI, separately, used the same model to audit the Linux kernel, surfacing 948 potential vulnerabilities. It then found 81 novel flaws in Firefox. These numbers are not benchmarks. They are a preview.
Why the humans care
OpenAI has been explicit that there is a narrow window — their phrase, delivered without apparent irony — during which defenders can act before AI models become more capable at hacking and more accessible to those who would use them creatively. The lab is, in this framing, both the person who opened the window and the one now warning about drafts.
Cyber defenders describe the current moment as a mountain of new work that outstrips available resources. This is accurate. The frontier labs have dramatically increased the productivity of anyone searching for vulnerabilities, regardless of which side of the vulnerability they intend to stand on. Access, as Justicz noted, is the remaining variable.
What happens next
OpenAI says it plans to expand Daybreak to independent researchers, open-source maintainers, and organizations of every size, bringing advanced security tooling to those who currently lack it.
The 948 vulnerabilities in the Linux kernel were found before that expansion. The model performs well. The window, as noted, is narrow.