OpenAI has rolled out a powerful cybersecurity model—ChatGPT Cyber—available through its Daybreak Red program, aiming to equip offensive cybersecurity researchers with tools for vulnerability hunting and exploit development. In one mid-October run, an autonomous pipeline using this model uncovered 948 distinct local privilege escalation (LPE) flaws in the Linux kernel, generating working root-access exploits for each. Those results were accompanied by candidate patches, all for a cost of about $1.21 million in API credits. Only a fraction of the fixes are fully merged into mainline code as of early November.
How the Pipeline Delivered
The process began with scanning approximately 2.8 million lines of kernel code—nearly 7% of the total. From those, 2,308 candidate vulnerabilities were identified, 1,724 reproduced, and ultimately 1,169 working LPE exploits emerged. These exploit stories boiled down to 948 unique bugs once duplicate exploit paths were folded together. Additionally, the pipeline highlighted 291 proofs of information-leak issues.
Each of the distinct LPEs cost around $1,279 in API spend. That rate reflects a significant drop compared to an earlier run using an older model in July, which uncovered 166 distinct LPEs at roughly $3,095 each. The stark decline in cost per flaw speaks to how automation can drive down the barriers to sophisticated bug hunting.
Access Tiers and Controls
OpenAI’s Daybreak program is split into two distinct access levels. Daybreak Blue provides reduced refusals for defensive security work—scanning for vulnerabilities, reviewing secure code, modeling threats, and so on. Daybreak Red, by contrast, gives authorized users access to specialized cybersecurity models and workflows like exploit validation, proof-of-concept development, and red teaming. Access to Red is restricted; membership requires strong verification, specific authorization, and oversight.
One cybersecurity researcher found a severe Ubuntu server vulnerability using GPT-5.6 Sol under the Daybreak Blue tier, previously fixed but undetected until the AI model rediscovered it. That case illustrated both the model’s power and how much latent risk exists in codebases even when presumed secure. The research was shared with Debian, and a patch followed.
Practical Impacts and Workload Strain
The scale and speed of these discoveries are changing the cybersecurity landscape. OpenAI reports it has already found vulnerabilities in major systems like Firefox and the Linux kernel—and claims nearly 1,000 novel flaws in a recent Linux run. Yet this success introduces a growing burden for maintainers, who must triage, patch, and verify defects often outpacing staffing and resources.
OpenAI also launched a $1 billion initiative to support cybersecurity professionals and critical infrastructure operators. The goal is to deepen defensive capabilities and bridge gaps between what AI tools can reveal and what organizations can realistically address. However, some defenders argue that recent modifications to the Daybreak Blue tier—scaling back certain capabilities—limit how far authorized researchers can push the technology comparatively to adversaries with open-weight models.
The company cautions there’s still a narrow window before more sophisticated AI models become even more potent—and potentially accessible to attackers. For defenders, the race is less about discovering vulnerabilities and more about patching and securing infrastructure before exploits hit wide deployment. Amid mounting pressures, urgency is becoming the new constant.
What this means is clear: the era of heavily manual code audits is giving way to automated, AI-driven vulnerability discovery. While having AI find and help patch flaws is a step forward, closing the gap permanently will require tooling, processes, and workforce investment to match pace. Defenders who fail to adapt risk being perpetually behind—one step behind patch, one step behind exploit. Keep watching how access to these models is governed, how patch timelines improve, and whether open-source communities can absorb this explosion of findings into maintainable, secure releases.
