OpenAI Debuts ChatGPT Cyber and $1B Fund as OpenSSH and Truffle Patch

Automated vulnerability discovery by frontier artificial intelligence models is reshaping defensive security operations, prompting new model releases, emergency open-source patches, and automated credential revocation programs announced on Thursday.

OpenAI Releases ChatGPT Cyber to Daybreak Red and Commits $1 Billion Initiative

OpenAI launched ChatGPT Cyber for vetted defenders in its Daybreak Red program alongside a $1 billion initiative to assist cybersecurity professionals safeguarding critical infrastructure such as electrical grids and municipal water systems.

OpenAI technical staff researcher Eric Wallace said the company is dedicating frontier compute pro bono to audit open-source software. An OpenAI scan of the Linux kernel that cost $1.2 million in compute uncovered 948 potential security issues—though researchers noted that spend remained smaller than the roughly $6 million in tokens OpenAI invested in tackling a theoretical fluid dynamics problem—while a separate audit of the Mozilla Firefox browser uncovered 81 novel vulnerabilities.

Independent defenders participating in OpenAI's lower-tier Daybreak Blue program—which currently counts thousands of vetted practitioners—reported both rapid discoveries and growing triage strain. Charge Robotics CTO Max Justicz used OpenAI's GPT-5.6 Sol model through Daybreak Blue to identify a severe vulnerability in Ubuntu and Debian Linux in just 2 hours, spending approximately $5,000 of his own funds on subscriptions and API tokens across several bug hunts.

Microsoft Previews November 2026 Security Suite Ahead of San Francisco Ignite

Ahead of its Microsoft Ignite conference running Nov. 17 through Nov. 20, 2026 in San Francisco and online, Microsoft announced its November 2026 security updates across 5 operational categories:

1. AI Agent Governance: Introduced Dynamic Permissions and Dynamic Agent Risk controls, alongside automated endpoint discovery capable of inventorying more than 50 local AI agents and Model Context Protocols (MCPs) running on Windows and macOS devices.
2. Windows Isolation: Brought Microsoft Execution Containers (MXC) on Windows into general availability to sandbox untrusted workloads at the operating-system layer.
3. Endpoint Privilege Management: Updated Microsoft Intune Endpoint Privilege Management so standard users can modify IPv4, IPv6, and DNS network configurations without full local administrator privileges.
4. Managed Detection & Sovereign Cloud: Launched a redesigned Managed Detection and Response (MDR) portal overview inside Microsoft Defender Experts for XDR and made Microsoft Defender for SQL Servers on Machines generally available in Azure Government.
5. Exposure Remediation: Added the "Secure Now" workflow inside Microsoft Security Exposure Management to accelerate high-priority configuration fixes.

OpenSSH 10.6p2 Patches musl C Library Disabled-Account Login Bypass

In open-source infrastructure, OpenSSH released version 10.6p2 to patch an authentication bypass affecting Linux distributions that pair OpenSSH with the lightweight musl C library—including Alpine Linux, OpenWrt, Buildroot, and Yocto—when Pluggable Authentication Modules (PAM) are disabled.

Security researcher Ozgun Kultekin uncovered the flaw after executing 17,600 automated authentication test cases with an AI agent. The bug originated from a 2016 timing-attack mitigation patch for CVE-2016-6210: when an attacker submits a password longer than musl's 256-byte limit to the "crypt()" function, musl returns the failure string "". On systems where locked or disabled accounts in "/etc/shadow" use "" in the password hash field, OpenSSH's string comparison evaluated "" against "" as a valid match, permitting login to disabled accounts.

Truffle Security Partners With 16 Issuers to Revoke 1.4 Million Exposed Secrets

Addressing credential sprawl across public repositories and developer workstations, Truffle Security launched the free Secrets Revocation Program to automatically invalidate 1.4 million live leaked API keys and access tokens uncovered by its open-source TruffleHog scanner.

Sixteen credential issuers—including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio—joined the program at launch, committing to verify and revoke leaked keys within 14 days of notification. Since January 2025, Truffle Security has cataloged more than 543,000 valid credentials in public GitHub repositories, 431,000 live AWS secrets, and 2,655 working keys embedded inside AI coding assistant configuration files. While 81% of manually reported secrets remained active 6 months after disclosure, Truffle Security pointed to Google's June 16, 2024 decision to enable default automatic revocation for Google Cloud keys—which slashed the share of leaked keys still active from 72% down to 11%—as proof that automated issuer revocation works at scale.