OpenAI Expands Cybersecurity Program as AI-Assisted Bug Hunting Accelerates

A robotics startup executive used an OpenAI model to uncover a severe flaw in code tied to Ubuntu, the widely used open source Linux-based operating system. Max Justicz, chief technology officer and co-founder of Charge Robotics, told TechCrunch he found the vulnerability through Daybreak Blue, an OpenAI program that gives cybersecurity defenders access to powerful models. He said he pointed the model at the same code where he had previously found a bug and asked it to look for issues as bad or worse.

The model returned a result in about two hours, according to Justicz, who described the flaw as extremely convoluted and difficult for a human to find. He reported it to the Debian Project, which maintains the software and issued a patch. There has been no known evidence of exploitation. Justicz said he spent roughly $5,000 on subscriptions and tokens to find several exploits, and he warned that less-audited code could be a rich target for anyone aiming a powerful AI model at it.

OpenAI has announced ChatGPT Cyber, a model focused on cybersecurity, would be available to the highest tier of users in its Daybreak Red program, which serves offensive cybersecurity researchers. The company said the same model had been used to scan and prepare patches for vulnerabilities in the Linux kernel, finding 948 potential issues, and to find 81 novel vulnerabilities in Firefox. OpenAI said its goal is to expand Daybreak to organizations of every size, independent researchers and open-source maintainers.

The company has also announced a $1 billion initiative to support cybersecurity professionals in the program who work on critical infrastructure such as the electrical grid or water systems. Justicz noted that OpenAI appears to have recently made Daybreak Blue less useful at finding vulnerabilities. He said he uploaded a photo of his driver's license to join the program, illustrating how access is gated. OpenAI says thousands of cybersecurity professionals are participating in Daybreak, versus a far larger number of potential hackers.

Eric Wallace, a researcher on OpenAI's technical staff, said the company is allocating a significant amount of its frontier compute toward discovering and patching vulnerabilities in open source codebases on a pro bono basis. The Linux bug hunt cost $1.2 million, according to the company.

Source: TechCrunch