OpenAI Launches ChatGPT Cyber and Promises $1 Billion for Cybersecurity

A passionate individual discovered a severe vulnerability affecting Ubuntu servers using an OpenAI model, which has since been patched without any known exploitation. Meanwhile, OpenAI announces ChatGPT Cyber for offensive research, promising one billion dollars in support and claiming hundreds of alerts on Linux and Firefox. Amid tight action windows, real costs, and contested safeguards, the security sector is questioning the situation.

Limited Resources Compared to the Scale of the Task

The hunt for vulnerabilities in Linux has cost $1.2 million, a figure to compare with the approximately $6 million spent by OpenAI for a potential solution to a fluid dynamics problem. Eric Wallace, a researcher on OpenAI's technical team, indicates that a significant portion of cutting-edge computing capacity is now dedicated, pro bono, to detecting and fixing vulnerabilities in open-source codebases. OpenAI emphasizes the existence of a narrow time window for defenders to act before AI models become more adept at hacking and more accessible. Only "thousands" of cybersecurity professionals are participating in the Daybreak program, while the number of potential hackers is much higher.

A Concrete Case: An Ubuntu Vulnerability Found and Fixed

Max Justicz, Chief Technology Officer and co-founder of Charge Robotics, used GPT 5.6 Sol via Daybreak Blue to identify a severe vulnerability that could allow the takeover of servers running Ubuntu, a widely used Linux distribution. A cybersecurity enthusiast, he had previously spotted a flaw in the same code. After asking ChatGPT to search for bugs as severe or worse than one fixed years earlier, a lead was returned to him two hours later, which he described as extremely complex but exploitable. The issue was reported to the Debian Project, which released a patch, and no exploitation has been reported.

What the Models Are Already Finding in Linux and Firefox

OpenAI claims that ChatGPT Cyber has been used to analyze the Linux kernel and prepare patches, identifying 948 potential issues. The company also mentions the discovery of 81 vulnerabilities classified as novel in the Firefox browser. These results stem from work conducted with its specialized cybersecurity model.

Access, Safeguards, and Entry Costs for Researchers

Daybreak Blue provides defenders with access to advanced models, while Daybreak Red offers tools to offensive security researchers for vulnerability hunting and development. OpenAI aims to significantly expand Daybreak to a wide range of stakeholders, and ChatGPT Cyber is announced for the Daybreak Red level. Max Justicz believes that Daybreak Blue has recently been weakened, reducing its utility for vulnerability research. He was able to join the program by uploading a photo of his driver's license. Some cybersecurity professionals feel their hands are tied if cutting-edge models are restricted, while malicious actors can use open-weight models without safeguards. Justicz indicates he has spent around $5,000 on subscriptions and tokens to conduct his research.

Financial Promise for Critical Infrastructures

OpenAI is launching an initiative with one billion dollars to support cybersecurity experts in the program who work on critical infrastructures such as power grids or water systems. At the same time, Max Justicz warns about the ease with which powerful models can help identify vulnerabilities and anticipates the discovery and exploitation of major vulnerabilities in the coming months if more time and less restricted models are available. He believes that auditing code or little-studied binaries by submitting them to a powerful AI model presents significant potential.