AI Lets Amateurs Find Critical Zero-Days in Hours | Max Justicz｜MTS

Max Justicz shows GPT-class models let novices find critical zero-days like an APT root-code-execution bug in Debian/Ubuntu and a remote Android cellular takeover in hours, arguing AI is commoditizing bug-finding while vast software remains unaudited.

Max Justicz, a security researcher who works on bug bounties on the side, argues that frontier AI models have made finding critical zero-day vulnerabilities so easy that unskilled users will soon be able to do it, and that defenders are not moving fast enough. He describes using GPT-5.6 to find a remote root code-execution bug in APT, the package manager behind Debian and Ubuntu, and later a remote takeover of a fully patched Android phone over cellular networks. The conversation covers how he found the bugs, why the labs are now restricting access to the models that found them, why ordinary users have few options, and what package maintainers should do now; the Android finding and the policy debate over "obliterated" models each get only a few minutes.

Justicz is introduced as someone who has done security research and bug bounties for years and who had previously audited package-manager code by hand, which is why he could aim a model at code he already knew. The briefing below covers the APT bug and its five-to-six-week patch window, the Android exploit, his view that his own skill advantage is temporary, the access restrictions at OpenAI and Anthropic, the case for and against services that sell unrestricted model access, and his advice for maintainers and end users.

A network attacker can force Debian and Ubuntu machines to install arbitrary software as root

Justicz aimed GPT-5.6 at package-manager code he had audited by hand years earlier, and after a couple of hours the model returned a bug in APT that, by his account, affects all Ubuntu and Debian machines. A man-in-the-middle on the network can force those machines to install arbitrary software as root. He frames package managers as the worst place for a bug because they are the main distribution channel for all software: "if you compromise the package manager, you compromise everything."

He reported the bug in September 2026. The fix and rollout took five or six weeks, which he attributes to people rather than engineering — the maintainers were partly on vacation during that window. In his view a patch could have been written and released the same day, so the delay was deployment urgency, not difficulty.

He treats the find as a signal coverage rather than his own ability: the speed with which he found the APT bug suggests nobody had yet aimed an AI model at that code. He extends the concern to less-watched software — he gives the example of radio firmware on an aircraft decoding signals from other planes — where the first person to point a model at the code will find whatever is there.

A fully patched Android phone was taken over by a malicious message over cellular

After the APT bug, Justicz bought a modern, fully patched Android phone and aimed the same models at it. He says he quickly found "the worst of the worst": a malicious message sent over cell networks could take over the phone and run arbitrary code. The patch for that finding was still being rolled out at the time of the interview.

His point is the effort required, not the severity alone. He describes himself as someone with a full-time job that is not security work, "dick[ing] around one afternoon" and finding and exploiting the bug in a few hours. He offers no mitigation for ordinary users against that class of attack.

His skill advantage is a leading indicator, not a moat

Justicz places himself on a spectrum rather than at the top of the field. He says he is not one of the world's best hackers but has had some success with bug bounties, and he has seen a large uplift in what he can do because of the models. The only edge he claims is taste in choosing which targets are worth pointing a model at, and he expects that edge to erode quickly:

"I have a little bit of taste in like being able to aim the models at things that I think are worth looking at, but like I mean, what kind of moat is that? Like, I don't think that's going to last very long."

"I have a little bit of taste in like being able to aim the models at things that I think are worth looking at, but like I mean, what kind of moat is that? Like, I don't think that's going to last very long."

He describes his work as a canary. A couple of months before the interview, the most skilled hackers were the ones seeing extra results from AI; at the time of the interview it was people like him; soon it will be normal computer users. He says he is "pretty confident" of that progression.

The labs are tightening access, and open-weight models are already dangerous enough

Asked why there has not been more material cyber harm to ordinary people, Justicz offers three explanations. First, the frontier labs are getting better at refusing egregious vulnerability-hunting requests: he used Daybreak Blue, which he describes as the easiest-to-access model tier with elevated security permissions that OpenAI offers, and says the same requests that found the APT bug no longer work since the find. He says he has not been able to get Claude to do anything very useful for him. Second, the number of actors trying to cause harm may be a rate limit — ransomware crews are still running ransomware campaigns. Third, and in his view most important, the tools have not been in enough hands for long enough.

He also tested an unrestricted open-weight model, GLM 5.3, run through a service that removes its safety restrictions. He calls it "a bit dumber" than the GPT-5.6 models he used but "certainly powerful enough to be dangerous" and capable of finding shallower bugs.

Selling unrestricted model access helps defenders now and looks bad later

On whether such services are net good, he splits the answer by time horizon. In the short term he sees them as good because they let defenders audit code faster, and he notes second-order effects — his own use of the service may be raising awareness of the problem. In the long term he calls it "probably net bad to be providing kind of misaligned AI as a service," because it normalizes access to models willing to do harmful things.

Ordinary users have little to do but reduce exposure and stay patched

Justicz says ordinary users are "in a pretty bad spot right now" and that the main lever is using fewer services. His pre-AI advice still stands: stick with major smartphone brands likely to be patched quickly, use major operating systems, and keep things up to date. He calls the current situation "a little bit feudal."

The structural problem he identifies is coverage. Popular devices may keep a high bar, but the surface area of modern life is too large for anyone to audit all of it, so security depends on who points a model at a given piece of code first.

The gap between finding and fixing is now the binding constraint

The episode's practical through-line is that AI has compressed discovery time to hours while patching still runs on human schedules. The APT bug went from find to patch in five to six weeks, partly because maintainers were on vacation; the Android patch was still rolling out at interview time. Justicz's forecast is that a wave of "really ridiculous bugs" is to surface and will get worse over the few months, and that a large coordinated effort is needed to aim powerful models at critical software to fix it before others exploit it. The unresolved tension is that the same access that lets defenders audit faster also lowers the skill floor for attackers, and the labs' tightening of access — which he observes directly — slows both sides at once.

Critical infrastructure codebases remain largely unaudited by AI models, so defenders who aim models at their own code first gain a meaningful advantage over attackers who look later.

Frontier AI labs are tightening access to elevated security-permission models, with the same vulnerability-hunting requests that previously worked no longer succeeding after the bug disclosure.

Open-weight models like GLM 5.3 are less capable than frontier GPT models but still powerful enough to find shallow bugs, meaning defenders can cheaply audit code while lowering the barrier for attackers.

I just bought a modern, fully patched Android phone, aimed the same models at it, and very quickly got kind of the worst of the worst finding where I could send a malicious message just over cell networks to an Android phone and take it over.

I just bought a modern, fully patched Android phone, aimed the same models at it, and very quickly got kind of the worst of the worst finding where I could send a malicious message just over cell networks to an Android phone and take it over.

I've seen just a massive uplift in what I can do because of these models. And I think that marginal difference due to my skills is just going to quickly diminish to the point where if you're completely unskilled, you'll be able to do the same thing.

I've seen just a massive uplift in what I can do because of these models. And I think that marginal difference due to my skills is just going to quickly diminish to the point where if you're completely unskilled, you'll be able to do the same thing.

The fact that I was able to find this app bug as quickly as I was kind of indicates to me that no one's even bothered to aim an AI model at this code.

The fact that I was able to find this app bug as quickly as I was kind of indicates to me that no one's even bothered to aim an AI model at this code.

I think that like marginal difference due to my skills is just going to quickly diminish to the point where if you're completely unskilled, you'll be able to do the same thing.

I think that like marginal difference due to my skills is just going to quickly diminish to the point where if you're completely unskilled, you'll be able to do the same thing.

If you compromise the package manager, you compromise everything.

If you compromise the package manager, you compromise everything.

I think the tools just aren't in enough people's hands to have caused major incidents. But I think we'll see them. I think it's kind of just a matter of time.

I think the tools just aren't in enough people's hands to have caused major incidents. But I think we'll see them. I think it's kind of just a matter of time.

Exploits Now Beat Patches: Open Source Security in the AI Era - Patrick Smyth, Chainguard

Aligning Multi-Agent Systems and Financializing Compute

How to Build an AI Code Review Agent - Daksh Gupta, Greptile

Ep. 031 - EMERGENCY EPISODE: Are We Doomed? | Jordan Nanos, Doug O'Laughlin, Max Kan, Joey Brookhart

AI Utopia + Rare-Disease Diagnosis | Joel Borgen & Daniel McKinnon

The Real Reason AI Founders Are Calling For a Slowdown | Conversations

GPT Astra & Fable 5.1 Accelerate the Model Race | Tesla Launches Cybercabs | Index Pulls Out of Town

The Changing Physics of Cybersecurity and Drug Development with OpenAI President Greg Brockman

Ep. 042 - GDPx: The Benchmark for Frontier AI | Andrew Megalaa, Jordan Nanos, Max Kan

The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents

Turing CEO on Super Intelligence, Open Source, Agents

Why most actions on the internet will soon be taken by AI (OpenAI’s head of ChatGPT, Tibo Sottiaux)

Max Justicz shows GPT-class models let novices find critical zero-days like an APT root-code-execution bug in Debian/Ubuntu and a remote Android cellular takeover in hours, arguing AI is commoditizing bug-finding while vast software remains unaudited.

Max Justicz, a security researcher who works on bug bounties on the side, argues that frontier AI models have made finding critical zero-day vulnerabilities so easy that unskilled users will soon be able to do it, and that defenders are not moving fast enough. He describes using GPT-5.6 to find a remote root code-execution bug in APT, the package manager behind Debian and Ubuntu, and later a remote takeover of a fully patched Android phone over cellular networks. The conversation covers how he found the bugs, why the labs are now restricting access to the models that found them, why ordinary users have few options, and what package maintainers should do now; the Android finding and the policy debate over "obliterated" models each get only a few minutes.

Justicz is introduced as someone who has done security research and bug bounties for years and who had previously audited package-manager code by hand, which is why he could aim a model at code he already knew. The briefing below covers the APT bug and its five-to-six-week patch window, the Android exploit, his view that his own skill advantage is temporary, the access restrictions at OpenAI and Anthropic, the case for and against services that sell unrestricted model access, and his advice for maintainers and end users.

A network attacker can force Debian and Ubuntu machines to install arbitrary software as root

Justicz aimed GPT-5.6 at package-manager code he had audited by hand years earlier, and after a couple of hours the model returned a bug in APT that, by his account, affects all Ubuntu and Debian machines. A man-in-the-middle on the network can force those machines to install arbitrary software as root. He frames package managers as the worst place for a bug because they are the main distribution channel for all software: "if you compromise the package manager, you compromise everything."

He reported the bug in September 2026. The fix and rollout took five or six weeks, which he attributes to people rather than engineering — the maintainers were partly on vacation during that window. In his view a patch could have been written and released the same day, so the delay was deployment urgency, not difficulty.

He treats the find as a signal coverage rather than his own ability: the speed with which he found the APT bug suggests nobody had yet aimed an AI model at that code. He extends the concern to less-watched software — he gives the example of radio firmware on an aircraft decoding signals from other planes — where the first person to point a model at the code will find whatever is there.

A fully patched Android phone was taken over by a malicious message over cellular

After the APT bug, Justicz bought a modern, fully patched Android phone and aimed the same models at it. He says he quickly found "the worst of the worst": a malicious message sent over cell networks could take over the phone and run arbitrary code. The patch for that finding was still being rolled out at the time of the interview.

His point is the effort required, not the severity alone. He describes himself as someone with a full-time job that is not security work, "dick[ing] around one afternoon" and finding and exploiting the bug in a few hours. He offers no mitigation for ordinary users against that class of attack.

His skill advantage is a leading indicator, not a moat

Justicz places himself on a spectrum rather than at the top of the field. He says he is not one of the world's best hackers but has had some success with bug bounties, and he has seen a large uplift in what he can do because of the models. The only edge he claims is taste in choosing which targets are worth pointing a model at, and he expects that edge to erode quickly:

"I have a little bit of taste in like being able to aim the models at things that I think are worth looking at, but like I mean, what kind of moat is that? Like, I don't think that's going to last very long."

"I have a little bit of taste in like being able to aim the models at things that I think are worth looking at, but like I mean, what kind of moat is that? Like, I don't think that's going to last very long."

He describes his work as a canary. A couple of months before the interview, the most skilled hackers were the ones seeing extra results from AI; at the time of the interview it was people like him; soon it will be normal computer users. He says he is "pretty confident" of that progression.

The labs are tightening access, and open-weight models are already dangerous enough

Asked why there has not been more material cyber harm to ordinary people, Justicz offers three explanations. First, the frontier labs are getting better at refusing egregious vulnerability-hunting requests: he used Daybreak Blue, which he describes as the easiest-to-access model tier with elevated security permissions that OpenAI offers, and says the same requests that found the APT bug no longer work since the find. He says he has not been able to get Claude to do anything very useful for him. Second, the number of actors trying to cause harm may be a rate limit — ransomware crews are still running ransomware campaigns. Third, and in his view most important, the tools have not been in enough hands for long enough.

He also tested an unrestricted open-weight model, GLM 5.3, run through a service that removes its safety restrictions. He calls it "a bit dumber" than the GPT-5.6 models he used but "certainly powerful enough to be dangerous" and capable of finding shallower bugs.

Selling unrestricted model access helps defenders now and looks bad later

On whether such services are net good, he splits the answer by time horizon. In the short term he sees them as good because they let defenders audit code faster, and he notes second-order effects — his own use of the service may be raising awareness of the problem. In the long term he calls it "probably net bad to be providing kind of misaligned AI as a service," because it normalizes access to models willing to do harmful things.

Ordinary users have little to do but reduce exposure and stay patched

Justicz says ordinary users are "in a pretty bad spot right now" and that the main lever is using fewer services. His pre-AI advice still stands: stick with major smartphone brands likely to be patched quickly, use major operating systems, and keep things up to date. He calls the current situation "a little bit feudal."

The structural problem he identifies is coverage. Popular devices may keep a high bar, but the surface area of modern life is too large for anyone to audit all of it, so security depends on who points a model at a given piece of code first.

The gap between finding and fixing is now the binding constraint

The episode's practical through-line is that AI has compressed discovery time to hours while patching still runs on human schedules. The APT bug went from find to patch in five to six weeks, partly because maintainers were on vacation; the Android patch was still rolling out at interview time. Justicz's forecast is that a wave of "really ridiculous bugs" is to surface and will get worse over the few months, and that a large coordinated effort is needed to aim powerful models at critical software to fix it before others exploit it. The unresolved tension is that the same access that lets defenders audit faster also lowers the skill floor for attackers, and the labs' tightening of access — which he observes directly — slows both sides at once.

Critical infrastructure codebases remain largely unaudited by AI models, so defenders who aim models at their own code first gain a meaningful advantage over attackers who look later.

Frontier AI labs are tightening access to elevated security-permission models, with the same vulnerability-hunting requests that previously worked no longer succeeding after the bug disclosure.

Open-weight models like GLM 5.3 are less capable than frontier GPT models but still powerful enough to find shallow bugs, meaning defenders can cheaply audit code while lowering the barrier for attackers.

I just bought a modern, fully patched Android phone, aimed the same models at it, and very quickly got kind of the worst of the worst finding where I could send a malicious message just over cell networks to an Android phone and take it over.

I just bought a modern, fully patched Android phone, aimed the same models at it, and very quickly got kind of the worst of the worst finding where I could send a malicious message just over cell networks to an Android phone and take it over.

I've seen just a massive uplift in what I can do because of these models. And I think that marginal difference due to my skills is just going to quickly diminish to the point where if you're completely unskilled, you'll be able to do the same thing.

I've seen just a massive uplift in what I can do because of these models. And I think that marginal difference due to my skills is just going to quickly diminish to the point where if you're completely unskilled, you'll be able to do the same thing.

The fact that I was able to find this app bug as quickly as I was kind of indicates to me that no one's even bothered to aim an AI model at this code.

The fact that I was able to find this app bug as quickly as I was kind of indicates to me that no one's even bothered to aim an AI model at this code.

I think that like marginal difference due to my skills is just going to quickly diminish to the point where if you're completely unskilled, you'll be able to do the same thing.

I think that like marginal difference due to my skills is just going to quickly diminish to the point where if you're completely unskilled, you'll be able to do the same thing.

If you compromise the package manager, you compromise everything.

If you compromise the package manager, you compromise everything.

I think the tools just aren't in enough people's hands to have caused major incidents. But I think we'll see them. I think it's kind of just a matter of time.

I think the tools just aren't in enough people's hands to have caused major incidents. But I think we'll see them. I think it's kind of just a matter of time.

Exploits Now Beat Patches: Open Source Security in the AI Era - Patrick Smyth, Chainguard

Aligning Multi-Agent Systems and Financializing Compute

How to Build an AI Code Review Agent - Daksh Gupta, Greptile

Ep. 031 - EMERGENCY EPISODE: Are We Doomed? | Jordan Nanos, Doug O'Laughlin, Max Kan, Joey Brookhart

AI Utopia + Rare-Disease Diagnosis | Joel Borgen & Daniel McKinnon

The Real Reason AI Founders Are Calling For a Slowdown | Conversations

GPT Astra & Fable 5.1 Accelerate the Model Race | Tesla Launches Cybercabs | Index Pulls Out of Town

The Changing Physics of Cybersecurity and Drug Development with OpenAI President Greg Brockman

Ep. 042 - GDPx: The Benchmark for Frontier AI | Andrew Megalaa, Jordan Nanos, Max Kan

The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents

Turing CEO on Super Intelligence, Open Source, Agents

Why most actions on the internet will soon be taken by AI (OpenAI’s head of ChatGPT, Tibo Sottiaux)