FoxTPNL / Wikimedia Commons (CC BY 4.0) A startup CTO used an OpenAI model to uncover a severe APT bug as the company widens its security-focused AI tooling
One of the more serious Linux security flaws disclosed this fall was not found by a dedicated bug hunter. It was found by a robotics startup’s CTO working with an OpenAI model.
Max Justicz, cofounder and chief technology officer of Charge Robotics, used OpenAI’s tooling to uncover a severe vulnerability. If exploited, it could have let attackers take control of servers running Ubuntu, one of the most widely used Linux-based operating systems.
A bug in the software that installs all the other software #
The flaw is tracked as CVE-2026-109518. It sits in APT, the package manager that Debian and Ubuntu systems use to install and update software.
According to the research findings, the vulnerability could enable man-in-the-middle attacks that bypass package verification. An attacker positioned between a server and its software source could slip in tampered code. That code could then run with root privileges, the highest level of control on the machine.
Justicz used OpenAI’s GPT-5.6 Sol model, accessed through the company’s Daybreak Blue tier, to identify the bug. He reported it in late September 2026 to the Debian Project, which maintains the affected software.
Debian shipped a fix, with patches available by early November 2026. There is no known evidence that anyone exploited the flaw before it was closed.
OpenAI’s growing cyber toolkit #
OpenAI has spent 2026 building out a family of AI models aimed specifically at security work.
Models such as GPT-5.4-Cyber and GPT-5.6-Cyber are designed for defensive tasks, including vulnerability research and exploit validation. On November 5, 2026, OpenAI announced GPT-6 Cyber, which the company says brings enhanced exploit detection and improved success rates.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
Access runs through OpenAI’s Trusted Access for Cyber program, known as TAC, which launched in February 2026. TAC requires verification, and approved users include security vendors and researchers.
The program is split into tiers. Daybreak Blue covers defensive operations. Daybreak Red is reserved for more advanced testing.
Scale, cost, and the automation question #
In October 2026, an automated research effort using OpenAI’s cyber models identified 948 unique vulnerabilities in the Linux kernel.
That effort was not cheap. It reportedly consumed approximately $1.21 million in API credits.
Divide that out and it works out to a bit over $1,200 per unique kernel vulnerability.
The research findings frame these efforts as part of a wider move toward AI-driven proactive defense. OpenAI is also reportedly increasing financial support for security work and expanding the TAC program.
What this means #
For security teams, the immediate takeaway is practical. Debian and Ubuntu systems should be running the patched version of APT. Anything still unpatched carries a known path to root-level compromise. Justicz is a startup CTO, not a full-time vulnerability researcher. A capable model let him find something serious in widely deployed infrastructure.
There is also a volume problem for maintainers. A scan that turns up 948 kernel vulnerabilities produces 948 items someone has to triage, verify, and fix. Open-source projects often run on thin resources. OpenAI’s reported financial support for security work is potentially as important as the models themselves.
The things to watch next: whether GPT-6 Cyber delivers on the improved success rates OpenAI has described, how quickly the TAC program expands its pool of approved users, and whether maintainers can absorb a rising flood of AI-generated bug reports without the backlog becoming its own security risk.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.