OpenAI announced Daybreak on June 22, a programme using a security-dedicated model to systematically audit open-source code. Published results include 24 local privilege escalation flaws in the Linux kernel and a critical vulnerability in a widely used web proxy.
The result matters for two opposite reasons. The first is defensive: open source underpins most infrastructure in use, and privilege escalation is the step that turns limited access into full control of a machine. Finding that at scale is a real gain.
The second is the discomfort. The same capability that audits finds what to exploit, and the difference lies in the operator's intent rather than the model. That exact criterion motivated, weeks later, pre-release review before a frontier model's public launch.
There's also a maintenance question the announcement doesn't resolve. Finding a flaw in an open project is easier than fixing it: the fix depends on maintainers, often volunteers, and a large volume of reports can overwhelm the people holding the base up.
For anyone operating infrastructure, the practical point is that the interval between a flaw existing and someone finding it is shrinking, on both sides.