Now that we have superhuman AI that can hack nearly anything, I welcome the announcement of Daybreak by the OpenAI team. Presumably these advanced cyber attack capabilities are still in the hands of state or other larger organizations, which means little fish like me probably aren’t the immediate target of these actors. That window is closing though, as OpenAI so delicately put it.
Once I saw the announcement I immediately signed up for the Trusted Access program. It took a few days for Daybreak Blue to show up, but today it was there! Daybreak Blue is a GPT5.6 Sol based model seemingly with cyber restrictions loosened (for defensive purposes, hence the blue name). In cybersecurity a “blue” team defends and a “red” team attacks. The red model is reserved for institutions and cybersecurity researchers.
The first thing I did was ask Daybreak Blue for a security audit of the various apps and services I have deployed on my main public server. It’s used for some business services, school services, and some personal projects (like my weather app). In one week these were the attack stats on this server:
- 31,050 rejected password guesses (Peak: 8,549 guesses in one day)
- 510 distinct hostile source IPs.
- Most-targeted usernames:
- root: 12,075
- admin: 1,598
- ubuntu: 1,487
- user: 959
- aum: 772
Notably password authentication only existed with a silly long password up until last week. This was an oversight and I really should have turned it off earlier. Now login is much more difficult but there are still about 2,000 attempts per day.
It also checked our main web proxy for a one hour snapshot of access attempts:
- 7,786 requests total.
- 109 recognizable vulnerability probes targeting .env, WordPress, .git, AWS credentials, PHPMyAdmin, and CGI paths.
- None received a successful response: 87 returned 404, 12 redirects, and 10 returned 502.
These are bots trying to find services on the server with exposed credentials, vulnerable paths, and common exploits in popular software like WordPress (which we don’t run on this server).
The funny thing is that this is the least surprising thing it found. Anyone who runs a server connected to the internet knows about these issues (vibe coders beware, there be dragons). Back in 2010 if I checked my server logs I would see very similar stats.
In general I feel like I run a solid server, and I’ve only knowingly had servers compromised a few times, and I’ve never lost any data. I do a monthly Common Vulnerabilities and Exposures (CVE) sweep on all my deployed apps and fix any CVEs that are known. I harden my servers and ensure the firewall only allows those ports that are necessary. Password login is always off (oops except this one, it’s the things you forget that can bite you).
For the most part, up until this year, the steps I’ve taken without Daybreak’s help would be enough to protect most small business or individual servers from most attacks. It wouldn’t be enough to protect against an “advanced persistent threat” like the NSA, Unit 8200, or any of the various Chinese or Russian APT groups. But I slept reasonably well knowing that I’m probably not the target of any of those groups. I simply run some business applications and a learning management system on this server.
Then all the news about offensive grade hacking models came out. I no longer feel any type of security. It doesn’t help that I’m reading Pandora’s Star, a book that features a super-intelligent AI that can break through insane levels of encryption and has advanced cyber capabilities. Sci-fi aside, the risk seems to be real and coming fast. So I’m doing what I can to reduce my attack surface. That is hard when most of the information in our lives today is digital and internet accessible.
Back when I briefly worked on staff for a member of Congress (circa 2010), I attended cybersecurity briefings aimed to help staffers protect themselves and their offices from attacks. These briefings were run by the NSA blue team. Back then it was mostly focused on mobile security. Being technical myself I knew all of the attack vectors they were talking about, but I could see the disinterest/confusion/apathy in the eyes of the audience. Most of these staffers were made to go by their offices, and the NSA team did a valiant job trying to make it understandable. Ever since I’ve had little hope that average people have any hope to secure their lives, and the real responsibility lies with our technology vendors and under appreciated systems administrators (buy yours a blueberry muffin next time you see them).
It is only a matter of time before open weight models obtain cyber capabilities, and then my server logs might start changing. If that happens, a single vulnerability or chain of small vulnerabilities can open your entire professional and personal digital existence. These days I’m mostly a CEO/president/professor, but I still do my sys admin duties on my cloud server, the rack at my university, and my home systems. I have given only passing thoughts to security for the past 6 or 7 years as my usual processes work great.
Daybreak Blue gave me some recommendations on further hardening my system, which I will promptly do. I’ll probably start a nightly or weekly CVE sweep as well. I only hope other sysadmins around the world are doing the same.
