OpenAI has released a model built for cybersecurity work. ChatGPT Cyber is available to the top tier of the company’s Daybreak programme, Daybreak Red, which gives offensive security researchers tools to find and develop vulnerabilities, TechCrunch reported on 5 November 2026. The day before, OpenAI said the model had scanned the Linux kernel and prepared patches, flagging 948 potential issues, and had found 81 “novel” vulnerabilities in the Firefox browser.
“Our goal is to dramatically expand Daybreak, bringing advanced security research to organizations of every size, independent researchers, and open-source maintainers,” OpenAI said. The company has also announced a $1bn initiative to support security professionals in the programme who protect critical infrastructure such as power grids and water systems.
Two hours to a severe bug
The report opens with a founder rather than a lab. Max Justicz, chief technology officer and co-founder of Charge Robotics, used an earlier OpenAI model, GPT 5.6 Sol, through the Daybreak Blue tier to find a severe vulnerability that could let attackers take control of servers running Ubuntu. He pointed the model at code where he had found a bug years before and asked for something as bad or worse. “It came back in two hours with this,” he told TechCrunch. “It’s extremely convoluted and hard for a human to find, but it works!”
He reported it to the Debian Project, which maintains the code and issued a patch. There is no known evidence the flaw was exploited. Justicz said he spent about $5,000 on subscriptions and tokens to find several exploits.
The limits of the programme
OpenAI says only “thousands” of security professionals take part in Daybreak, against a far larger number of potential attackers. Justicz said joining needed only a photo of his driving licence, and that OpenAI appears to have recently made Daybreak Blue less useful for finding vulnerabilities. Security professionals cited by TechCrunch say they work with one hand tied while attackers can run open-weight models with their safeguards removed.
The spending is also modest by OpenAI’s standards. Eric Wallace, a researcher on OpenAI’s technical staff, said the company is “allocating a significant amount of our frontier compute” to finding and patching flaws in open-source code, “fully pro bono”. TechCrunch reports the Linux bug hunt cost $1.2m, against about $6m in tokens spent on a well-known fluid dynamics problem.
What it means for founders and investors
- Unaudited code is now cheap to attack. If a hobbyist can find a severe flaw in two hours for a few thousand dollars, so can an attacker. Start-ups should assume their own code and dependencies will be scanned by models, and scan them first.
- Patching is the bottleneck. Finding 948 potential issues is the easy part. The work falls on maintainers and security teams, which is where demand for tools and services will grow. CrowdStrike’s purchase of two AI security start-ups this week, for about $500m in total according to The Wall Street Journal, points the same way.
- Access policy is a product decision. Who gets the strongest models, and on what checks, will shape both the market and the risk. Investors in security start-ups should ask what their product does if the labs tighten or widen access. This is analysis, not investment advice.
Sources
- TechCrunch, “OpenAI released a new cybersecurity model. Is that enough?” (5 November 2026)
- TechCrunch, “CrowdStrike to shell out nearly $500M for 2 AI security startups” (3 November 2026)
Photo: Data security breach illustration, by Blogtrepreneur, CC BY 2.0, via Wikimedia Commons.
.jpg){kind=link}