OpenAI's ChatGPT Cyber lands as AI flushes out 948 Linux kernel bugs

OpenAI has a new weapon for the cybersecurity crowd. The company announced ChatGPT Cyber on Wednesday, a model built for vulnerability hunting, available only to the top tier of users in its Daybreak Red program — the offensive-security side of its Daybreak effort. The pitch: give professional bug hunters frontier models before the other guys get them.

The timing isn't subtle. A day earlier, OpenAI said the same model scanned the Linux kernel and prepared patches for 948 potential vulnerabilities, while also surfacing 81 flaws in Firefox that hadn't been seen before. In a statement, the lab said it wants to dramatically expand Daybreak, putting advanced security research in the hands of organizations of every size, independent researchers and open-source maintainers.

The pressure is real. Max Justicz, cofounder and CTO of Charge Robotics, told TechCrunch he pointed GPT 5.6 Sol — released in July — at a codebase through the Daybreak Blue program and asked it to find bugs as bad or worse than one he'd spotted years ago. Two hours later it handed him a severe Ubuntu server vulnerability. He reported it to the Debian Project, which maintains the software and shipped a patch. There's no known evidence anyone exploited it.

Justicz keeps a hobbyist's interest in security and says the exploit was convoluted enough that a human would struggle to spot it. He also put a price on the hunt: roughly $5,000 spent on subscriptions and tokens. He warned that the same playbook — aiming a powerful model at code nobody has audited yet — still has huge alpha, and that defenders should brace for wild bugs surfacing fast.

OpenAI is sweetening the deal with money. Alongside the model access, it announced a $1 billion initiative backing cybersecurity pros in the program who work on critical infrastructure like the electrical grid and water systems. Researcher Eric Wallace said the company is now devoting a significant chunk of its frontier compute to finding and patching open-source vulnerabilities, entirely pro bono. The Linux bug hunt, notably, ran about $1.2 million — a fraction of the roughly $6 million in tokens OpenAI spent cracking a famous fluid dynamics problem.

Not everyone is cheering. Justicz said the lab appears to have recently nerfed Daybreak Blue, dulling its vulnerability-finding edge. He only had to upload a photo of his driver's license to join. Locking things down may keep bad actors out, but security professionals argue they're fighting with one hand tied while attackers can run open-weight models with the guardrails stripped out. OpenAI says just thousands of professionals are in Daybreak — a rounding error next to the pool of potential hackers. With a narrow window to patch the world's digital plumbing, the clock is loud.