OpenAI's Cybersecurity Model: What It Is, Who Gets It
OpenAI has released a bug-hunting model to vetted researchers through its Daybreak programme. What it found, who can use it and the limits.
OpenAI has released a model built for finding and fixing software vulnerabilities, and put it in the hands of a limited group of security researchers. TechCrunch, which reported the launch on 5 November 2026, refers to it as ChatGPT Cyber; the naming around it has varied, so we describe it here simply as OpenAI's cybersecurity model.
What it does
The model reads large codebases, looks for flaws an attacker could exploit, and helps write fixes. OpenAI has published two headline results:
- a scan of the Linux kernel that flagged 948 potential issues;
- 81 "novel" vulnerabilities in Firefox.
"Potential issues" is an important phrase. Automated findings must be confirmed by people, and many turn out to be minor or not exploitable. The numbers show scale, not a count of serious bugs.
Who can use it
Access runs through Daybreak, OpenAI's programme for security professionals, which has tiers:
- Daybreak Blue gives defenders access to capable models for finding and fixing problems.
- Daybreak Red, the highest tier, is for offensive security researchers who hunt for vulnerabilities. The new model is available there.
Applicants are vetted. One researcher told TechCrunch he had to upload a driving licence to join. OpenAI says "thousands" of defenders are enrolled.
It is not available in the ordinary ChatGPT app. The GPT-6 models in ChatGPT refuse some cybersecurity requests by design; see GPT-6 explained.
How to use it
If you work in security:
- Check whether your organisation qualifies for the Daybreak programme on OpenAI's website.
- Apply with the identity and employer verification it asks for.
- Start with code you own or are authorised to test. Unauthorised testing is illegal in most countries, whatever tool you use.
- Treat every finding as a lead to verify, then report confirmed bugs to the maintainers through their disclosure process.
If you do not work in security, there is nothing to install. The practical step is the old one: apply updates promptly. More bugs being found means more patches being issued.
The case that it is working
TechCrunch describes a researcher who used an earlier Daybreak model to find a serious flaw that could have let attackers take over servers running Ubuntu. He reported it, a patch was issued, and no exploitation has been reported. He said the model found the bug in about two hours.
OpenAI has also announced a $1 billion programme to support defenders of critical infrastructure such as power and water systems, and says it is using its own computing power to find and patch flaws in open-source software free of charge.
The criticisms
The article's title asks whether this is enough, and it gathers several doubts.
- Scale. Thousands of approved defenders is a small number next to the potential pool of attackers.
- Gatekeeping cuts both ways. Identity checks keep out some bad actors and also slow down legitimate defenders, especially volunteers who maintain open-source software.
- Attackers have alternatives. Open-weight models can be run with safeguards removed, so restricting the best tools does not stop determined attackers.
- Consistency. One researcher believes a lower tier was recently made less effective.
- Spending. TechCrunch contrasts roughly $1.2 million spent on the Linux bug hunt with an estimated $6 million in computing spent on a single physics problem.
The wider context
Security has become one of the main tests of how AI companies handle powerful capabilities. In 2026 several developers held back or restricted models because of what they could do in this area, while offering them to selected defenders first. The approach is the same across the industry: give defenders a head start, and hope the bugs are fixed before the same capability becomes widely available.
Whether that head start is long enough is the open question.
What is not yet known
- The model's official name and technical details.
- How many of the reported findings are confirmed, serious vulnerabilities.
- Whether and when similar capability will reach general-purpose products.
Sources
Frequently asked questions
Can I use OpenAI's cybersecurity model in ChatGPT?
No. It is limited to vetted researchers in the top tier of OpenAI's Daybreak programme.
What did the model find?
OpenAI says it flagged 948 potential issues in the Linux kernel and 81 novel vulnerabilities in Firefox. Automated findings still need human confirmation.
Is this dangerous?
Tools that find vulnerabilities can help attackers as well as defenders, which is why access is restricted. The aim is to get flaws fixed first.
What should ordinary users do?
Keep your operating system, browser and apps updated. Faster bug discovery means more security patches.
This article was checked against the sources listed above on 12 November 2026. AI products change quickly: features, prices and availability can differ by plan and country, so confirm details with the company before relying on them. GetAIHow is independent and not affiliated with the companies it covers. Read our editorial policy and disclaimer.
