The case that preceded the announcement
A few weeks before the announcement, Max Justicz, chief technology officer and cofounder of the startup Charge Robotics, used an OpenAI model to identify a serious vulnerability in the code of Ubuntu, a widely used open-source operating system based on Linux. According to his account to TechCrunch, if exploited it could have allowed attackers to take control of servers. Justicz said he used GPT 5.6 Sol, released in July, through Daybreak Blue, the program through which OpenAI gives cyber defenders access to frontier models.
A model for offensive cybersecurity
OpenAI has announced ChatGPT Cyber, a model dedicated to cybersecurity and reserved for the highest tier of the Daybreak Red program, which provides tools to offensive security researchers for vulnerability research and development. The company said the same model had been used the day before to analyze and prepare patches for flaws in the Linux kernel, identifying 948 potential issues, and to find 81 vulnerabilities described as new in Firefox.
OpenAI argues that there is a narrow window for those protecting digital infrastructure to act before models become more capable of attacking and easier to obtain. It also announced a $1 billion initiative to support professionals in the program working on critical infrastructure such as power grids and water systems.
Costs, access and resources still to be clarified
Justicz reported that he had personally spent about $5,000 on subscriptions and tokens to find several vulnerabilities, and noted that OpenAI appears to have recently weakened Daybreak Blue, making it less useful for identifying flaws. He also observed that signing up for the program required only uploading a photo of his driver's license. Security professionals complain that their hands are tied if they cannot use frontier technology while attackers can use open-weight models without filters.
OpenAI says only a few thousand professionals participate in the Daybreak program, compared with a much larger number of potential attackers. Eric Wallace, a researcher on the technical staff, said the company is devoting a significant share of its frontier computing power to discovering and fixing vulnerabilities in open-source codebases, free of charge. But hunting bugs in Linux cost $1.2 million, far less than the roughly 6 million tokens spent trying to solve a well-known fluid dynamics problem. It therefore remains to be seen whether the announced commitment is proportionate to the urgency that OpenAI itself describes.
