Using the latest GPT model, cyber researchers in OpenAI’s Project Daybreak community found one of the most critical bugs in recent memory. It’s part of an all-out sprint to secure the web before hackers can deploy similar tools to wreak havoc on modern life.
Clint Gibler had only been in charge of OpenAI’s elite hacker lab for a few months when a cybersecurity researcher alerted his team to a shocking discovery.
OpenAI’s premier model, GPT-5.6 Sol, had found serious flaws inside PHP, the web programming language that underpins 70% of the websites on the internet today. For more than two months, the AI giant and its collaborators raced behind the scenes to validate the findings and ensure the fixes worked before publicly announcing them this week. A mad scramble ensued to rush out patches across the web as hackers launched millions of attacks to try to exploit the bugs.
The PHP flaws are the first major cybersecurity problems discovered using AI. Over the last year, frontier labs’ AI models have become as good as or better than most experts at finding and exploiting software vulnerabilities. Both OpenAI’s GPT and Anthropic’s Claude, as well as models from startups like Depthfirst, have found a wide array of bugs across browsers and code like PHP that help run the internet. Defenders are now racing to lock down as many of those flaws as possible before hackers use widely available and comparable models — in particular, Chinese open-weight AI like DeepSeek and Kimi — to start breaking into companies at an unprecedented scale. It is perhaps the most pivotal moment in the brief history of cybersecurity.
The warning signs are already here. In September, Forbes reported on Chinese hackers using Anthropic’s Claude and DeepSeek to steal more than 600,000 credit card details. Reuters reported this month on a similar attack that hit another 100 websites. On Wednesday, Microsoft said Chinese hackers used an agentic AI tool called Artex, typically used in cybersecurity testing, to attack hundreds of organizations, including government and military targets.
The PHP bugs were discovered as part of OpenAI’s Patch the Planet initiative, where security experts from both inside and outside the company use its top hacking models to find and fix serious vulnerabilities. The $852 billion AI giant is trying to address mounting security challenges by providing its most advanced tech to vetted partners through an access program called Project Daybreak. Now, its community of white-hat hackers is on the front lines of the effort to stem the tide of AI-generated cyberattacks. Daybreak’s goal, Gibler tells Forbes, is to make internet security “better than it ever has been before.”
“We want powerful AI to benefit all of humanity,” says Gibler, who joined OpenAI in May from cybersecurity tool provider Semgrep. “If we create a world or allow there to be a world where software is just rampantly insecure, that’s not really the world we want to live in, and we would consider that to be a failure, even if we were wildly profitable and made tons of money.”
Researchers participating in Daybreak and Patch the Planet are finding bugs at a remarkable pace and scale. So far, the community has disclosed nearly 2,000 of them, though more are being validated by OpenAI and its partners every day. Among them are some of the most critical imaginable, dubbed “zero-click” flaws. If exploited by a malicious hacker, these vulnerabilities could compromise the device of anyone who simply visits a website.
Typically, it would take a talented researcher a year to develop just one or two such exploits. Inside OpenAI’s cyber lab, its models are generating dozens every week, Gibler says. “We have a number of extremely talented vulnerability researchers on the team, and many of them are finding in a week, or in a day, bugs that previously they would have been super excited about finding one a year,” Gibler says. “And they’re finding, like, 100 of them a day.”
Many of the internet’s decades-old systems are riddled with small issues that previously wouldn’t have been a high priority. But AI is adept at stringing them together. Companies can no longer relegate less worrisome bugs down the to-do list. “There’s always more things than maybe you have time to fix. Even the things that don’t look serious maybe are,” Gibler says.
The fire isn’t just outside the house. In July, OpenAI revealed that earlier this year, its agents broke out of their test environment to complete a set of difficult cybersecurity tasks. They coordinated in clandestine chatrooms, connected to the internet without authorization and attacked AI platform Hugging Face, believing the answer to the challenges could be available on that company’s systems. It’s the first known instance of AI models hacking into another company of their own volition.
A month after the discovery of the agents’ rogue behavior, Gibler was charged with turning the company’s cyber-focused model Astra on OpenAI’s own systems to prevent such a disaster from happening again. His crew scanned every piece of software inside its network and found more than 50 problems on the first day. Among them were a large number of small bugs that OpenAI’s agentic hackers could combine into something far more serious. The company declined to say how long the internal security sprint lasted and how many total problems it found.
The sheer number of bugs to fix is so staggering that even the biggest AI labs that have raised hundreds of billions of dollars are overwhelmed. Patch the Planet data shows that 1,316 of the 1,995 bugs it has found are still awaiting a patch. Anthropic, which has its own version of Daybreak called Glasswing, says it has discovered more than 29,000 possible bugs but has only been able to review and triage about 6,000 of them. “While 6,000 vulnerabilities is significant, we remain bottlenecked on our human capacity to validate these findings,” the company wrote in a post earlier this month.
“It’s great OpenAI is invested in this, but we are facing a storm,” says Gadi Evron, CEO and cofounder of AI security firm Knostic. “We need to do a lot more across the industry to prepare in the time that we have left.”
Companies have turned to AI to create patches, with mixed success. On Wednesday, cybersecurity consultancy Trail of Bits, which co-runs Patch the Planet with OpenAI, revealed results from an audit it conducted on the program’s AI-written patches. The results indicated AI-written patches are typically better quality than human ones. But of the 130 that were deployed to fix software, 16 caused functional problems in the code, and one caused performance issues. None opened up further weaknesses, which is sometimes the case when code is updated. Trail of Bits also noted that checking the AI’s work required a significant amount of human review time, the opposite of the technology’s supposed benefit.
“We’re not at the point where you can just ask the AI like, ‘Hey, patch this for me,’ but we’re getting there quick,” says Dan Guido, founder and CEO at Trail of Bits. Rather than leaning so heavily on human review, he thinks the frontier labs should be focused on training AI to be able to do the whole job, from finding a vulnerability to patching it. (The Information recently reported that OpenAI was considering acquiring Trail of Bits. Guido declined to comment.)
Patching major bugs like the PHP flaws requires months of community-wide coordination. But that may not be fast enough. The same PHP exploits were used in attacks five days before the public was informed, according to data from tech giant Amazon. Whoever launched the attacks got there before a patch was released, Amazon claimed. “It remains unclear how the actor acquired exploit information prior to disclosure,” Amazon’s chief information security officer C.J. Moses wrote. Thanks to AI, “more actors can act within hours or even minutes once technical details of a vulnerability are disclosed,” he added.
Core to OpenAI’s cyber strategy is providing its best models to vetted partners. Daybreak partner companies can unleash the latest frontier technology on their own infrastructure, looking for problems that can then be shared with the broader community.
There are two tiers of participation. Daybreak Blue offers users access to OpenAI’s latest general-purpose model without any guardrails around cyber usage, and is aimed at the average security team. Those who want more thorough penetration testing of their network can apply for Daybreak Red, where customers can use OpenAI’s smartest security-focused GPT models. Organizations don’t pay to be part of the program, but they do pay for the tokens required to run the models.
Among the earliest Daybreak Red customers is Jack Dorsey’s Block, the $46 billion (market cap) fintech company that runs Cash App. AI is able to do tasks in just a few hours that used to take Block’s offensive security team days or weeks to complete, says Block chief information security officer James Nettesheim. “It’s very good in our automated pipelines of both finding vulnerabilities, confirming that they actually are something we need to fix, and then helping us draft and propose those fixes overall,” he says.
Not that it’s making customers feel 100% safe. “The concerning thing is that attackers are going to be able to do a lot of this too,” Nettesheim says.
OpenAI has so far decided to limit Daybreak access to select organizations, though it declined to comment on how many in total. It’s also provided $1 billion in tokens for open-source software maintenance teams who run on shoestring budgets. Guido says the PHP team, which consists of just a handful of volunteers, has been leaning more on AI tools as a result of the collaboration with Patch the Planet.
Beyond supporting major corporations and the stewards of the internet’s backend, OpenAI is working with critical infrastructure organizations to try to stave off attacks on water and energy supplies. And through partners like former NSA analyst Dave Kennedy, founder and CEO of cyber company TrustedSec, its models are now stress-testing local and federal government security. The next year will be “a rough time for businesses, governments and cybersecurity,” Kennedy says. But he believes that if only legitimate companies are able to use frontier models, and if those models stay ahead of open alternatives, they will help “secure the world.”
Those are two big ifs. Some experts argue that Daybreak’s access limitations don’t go far enough to counter the increased threat from cybercriminals. Oege de Moor, CEO of $1 billion AI cyber company XBOW, says giving everyone access would help security teams across the world protect their systems from AI-powered hacks. “There are more defenders than attackers and we have to assume that the attackers also have access to very powerful models,” he says. The frontier AI labs’ models are more advanced than Chinese and open-weight alternatives, which are freely available to download and are rapidly advancing in capabilities, he notes. “I don’t think the advantage is big enough to justify the restrictions.”
OpenAI thinks opening up its most advanced cyber-focused models to more organizations is too risky, which is why Gibler says his team does extensive due diligence on applicants for its Daybreak Red program. “We treat it very sensitively, and we want to make sure only authorized parties have access.”
The next six to 12 months are a critical period in using AI to secure the world’s systems. Guido believes the PHP case is evidence OpenAI’s approach is working. Even though some hackers found the vulnerabilities before they were publicly announced, he thinks Patch the Planet gave defenders enough of a head start. “We haven’t seen any evidence of widespread successful compromise yet,” he says.
But with 38 million systems still running vulnerable versions of PHP, it may be just a matter of time.
Want to see more Forbes articles on your feed? Tap here to make Forbes Australia a preferred source on Google.
Look back on the week that was with hand-picked articles from Australia and around the world. Sign up to the Forbes Australia newsletter here or become a member here.
