From TechCrunch · Tim Fernholz · · 2m
OpenAI's cybersecurity model finds bugs fast. Can defenders keep up?
OpenAI released ChatGPT Cyber to help security researchers find vulnerabilities, but the ease of discovery raises questions about whether defenders can patch systems faster than hackers can exploit them.
In brief
OpenAI released ChatGPT Cyber to help security researchers find vulnerabilities, but the ease of discovery raises questions about whether defenders can patch systems faster than hackers can exploit them. OpenAI launched ChatGPT Cyber for cybersecurity researchers, but experts warn AI-powered vulnerability discovery is…
A hobbyist finds a critical Ubuntu bug
Max Justicz, chief technology officer of Charge Robotics, used OpenAI's GPT 5.6 Sol to find a severe vulnerability in Ubuntu, a widely used Linux-based operating system.The bug could allow hackers to take control of servers.
He found it through Daybreak Blue
Justicz accessed GPT 5.6 Sol through Daybreak Blue, OpenAI's program giving cybersecurity defenders access to powerful frontier models. He had previously found a vulnerability in the same codebase years earlier.
The AI found it in two hours
Justicz told ChatGPT about his previous bug fix and asked it to find issues as bad or worse.The model returned a severe vulnerability in two hours.
“I literally just aimed ChatGPT at the same body of code and said 'I found this bug previously that was fixed several years ago, please find bugs as bad or worse,' and it came back in two hours with this.”
The vulnerability was extremely hard to spot
Justicz said the bug was extremely convoluted and difficult for a human to find, but the AI model found it and confirmed it works. There has been no known evidence of exploitation so far.
“It's extremely convoluted and hard for a human to find, but it works!”
OpenAI launches ChatGPT Cyber
OpenAI announced ChatGPT Cyber, available to the highest tier of users in Daybreak Red, a program for offensive cybersecurity researchers hunting vulnerabilities. The model was used to scan the Linux kernel and find potential issues.
The Linux kernel scan found 948 issues
OpenAI said ChatGPT Cyber had been used to scan and prepare patches for vulnerabilities in the Linux kernel, finding nine hundred forty-eight potential issues. The model also found eighty-one novel vulnerabilities in Firefox.
Defenders say they're overwhelmed
Justicz warned that AI models will find extremely serious bugs over the next few months, and that bad actors with access to less restricted models will have an advantage.
“I can only imagine what one could do with more time and access to less neutered models.”
OpenAI is spending less than expected
OpenAI's Eric Wallace said the company is allocating significant frontier compute to finding and patching vulnerabilities in open source codebases for free.
The window to patch is closing
OpenAI has said there is a narrow window of time for digital infrastructure defenders to act before AI models become better at hacking and easier to access.Experts question whether current resources and urgency are sufficient.
In short
OpenAI launched ChatGPT Cyber for cybersecurity researchers, but experts warn AI-powered vulnerability discovery is outpacing defenders' ability to patch systems before attackers exploit them.
