AI model helps find severe Ubuntu vulnerability in two hours

Max Justicz, the chief technology officer and cofounder of the startup Charge Robotics, told TechCrunch he found the vulnerability using GPT 5.6 Sol, an OpenAI model released in July, through the company’s Daybreak Blue programme, which gives cybersecurity defenders access to advanced AI models.

“I literally just aimed ChatGPT at the same body of code and said ‘I found this bug previously that was fixed several years ago, please find bugs as bad or worse,’ and it came back in 2 hours with this,” Justicz said. The flaw affected software maintained by the Debian Project and, if exploited, could allow hackers to take control of servers running the widely used Ubuntu operating system. There has been no known evidence of exploitation.

Justicz, who has a hobbyist interest in security and previously found a vulnerability in the same codebase, said he spent about $5,000 on subscriptions and tokens to find several exploits. The ease with which he found this bug suggests that we have only seen the tip of the iceberg in potential exploits novice hackers can use with AI models. “I can only imagine what one could do with more time and access to less neutered models. We should expect some extremely crazy bugs to be found and exploited over the next few months,” he wrote in a social media thread.

OpenAI appears to have taken notice. The company announced a new model, ChatGPT Cyber, to be made available to the highest-tier users of its Daybreak Red programme, which allows offensive security researchers to hunt for vulnerabilities. The company said it used the same model to scan the Linux kernel, finding 948 potential issues, and identified 81 “novel” vulnerabilities in the Firefox browser.

“Our goal is to dramatically expand Daybreak, bringing advanced security research to organizations of every size, independent researchers, and open-source maintainers,” OpenAI said in a statement. The company has insisted there is a narrow window for defenders to act before AI models become even better at hacking. It also announced a $1 billion initiative to support cybersecurity professionals in the programme who work on critical infrastructure.

But Justicz said the frontier lab appeared to have recently “nerfed” Daybreak Blue, making it less useful at finding vulnerabilities. While limiting access to potential bad actors may be prudent, Justicz said he uploaded a photo of his driver’s licence to join the programme; cybersecurity professionals say they have one hand tied if they cannot use frontier technology while bad actors can deploy open-weight models with abliterated guardrails. OpenAI says only “thousands” of cybersecurity professionals participate in Daybreak, versus a far larger number of potential hackers.

Eric Wallace, a researcher on OpenAI’s technical staff, said that “we are now allocating a significant amount of our frontier compute towards discovering and patching vulnerabilities in open source codebases, fully pro bono.” The Linux kernel bug hunt cost $1.2 million, significantly less than the approximate $6 million token spend OpenAI invested in finding a potential solution to a problem in fluid dynamics. Justicz wrote: “This might be obvious to most folks here, but there is currently huge alpha in taking some code or binary someone has not audited yet and just aiming a powerful AI model at it.”