A cybersecurity hobbyist used OpenAI’s GPT-5.6 Sol to uncover a severe flaw in APT, the package manager used by Debian and Ubuntu; the Debian Project patched it, and there is no known evidence it was exploited.

The researcher, Charge Robotics cofounder and CTO Max Justicz, asked the model to look for a flaw as serious as one he had previously found, and it returned the vulnerability within two hours—raising concerns that sophisticated bug hunting could become accessible to less experienced users.

Tracked as CVE-2026-109518, the vulnerability could have let a man-in-the-middle attacker bypass package verification and install malicious code that runs with root privileges.

Justicz reported the flaw to the Debian Project in late September 2026, and Debian released a fix by early November.

Debian and Ubuntu users are urged to install the patched APT version, while maintainers face the challenge of triaging and fixing a growing volume of AI-generated vulnerability reports.

OpenAI offers its cybersecurity-focused models through Trusted Access for Cyber, launched in February 2026, with Daybreak Blue for defensive operations and Daybreak Red for more advanced testing.

OpenAI said ChatGPT Cyber, available to top-tier participants in Daybreak Red, helped identify 948 potential Linux kernel issues and 81 novel Firefox vulnerabilities and prepare patches.

An automated effort reportedly found 948 unique Linux kernel vulnerabilities in October 2026, using about $1.21 million in API credits—slightly more than $1,200 per vulnerability.

OpenAI researcher Eric Wallace said the company is dedicating substantial frontier-computing resources to finding and patching open-source vulnerabilities for free, but the Linux effort’s $1.2 million cost has prompted questions about whether the investment and urgency are sufficient.

Daybreak has only thousands of participants, while potential attackers are far more numerous; Justicz said he spent about $5,000 on subscriptions and tokens to find several exploits.

Justicz said OpenAI appeared to have reduced Daybreak Blue’s vulnerability-finding capabilities to limit misuse, a restriction that defenders fear could leave them at a disadvantage against attackers using less-restricted open-weight models.

On November 5, 2026, OpenAI announced GPT-6 Cyber, claiming it improves exploit detection and success rates; those claims remain to be assessed.