Max Justicz bought a brand-new, fully patched Android phone, pointed the same AI models he’d used on server software at it, and within hours found a way to take it over remotely — sending a malicious message over the cell network to seize control of the device. That finding, and a separate remote root code-execution bug in the package manager behind every Debian and Ubuntu machine, are the strongest evidence yet that the hardest part of security research — finding the flaw — has been radically democratized, according to Justicz, speaking on the MTS podcast.
“The worst of the worst finding where I could send a malicious message just over cell networks to an Android phone and take it over,” he said, describing the Android result. He is not a full-time security researcher; he has a day job and does bug bounties on the side. That’s precisely his point: what took him “dicking around one afternoon” would, until recently, have demanded expertise built over years.
The package manager is the most dangerous place to find a bug
The APT bug came first. Justicz had audited package-manager code by hand years earlier, which gave him the intuition to aim GPT-5.6 at it. After a couple of hours, the model returned a flaw that, by his account, affects all Ubuntu and Debian machines: a man-in-the-middle on the network can force those machines to install arbitrary software as root. “If you compromise the package manager, you compromise everything,” he said.
He reported the bug in September 2026. The fix and its rollout took five or six weeks — a delay he attributes to people, not engineering, since maintainers were partly on vacation during the window. In his view, a patch could have been written and shipped the same day.
The more telling signal, he argues, is what the speed of the find says about coverage. “The fact that I was able to find this app bug as quickly as I was kind of indicates to me that no one’s even bothered to aim an AI model at this code,” he said. That gap extends well beyond Linux: he points to radio firmware on an aircraft that decodes signals from other planes as an example of software where the first person to point a model at the code will find whatever is there.
A patch is not a fix when it takes six weeks
The episode’s practical through-line is a widening gap between how fast AI can find flaws and how fast humans can fix them. Discovery now runs in hours; patching still runs on human schedules, vacations included.
| Bug | Reported | Patch status | Time to patch |
|---|---|---|---|
| APT (Debian/Ubuntu package manager) | September 2026 | Rolled out | 5-6 weeks |
| Android remote takeover over cellular | During the interview period | Still rolling out | Ongoing at interview time |
For ordinary users, Justicz has little comfort to offer. “I think ordinary users are in a pretty bad spot right now,” he said, and the main lever is using fewer services. His pre-AI advice still holds: stick with major smartphone brands likely to be patched quickly, use major operating systems, and keep everything up to date. He called the current situation “a little bit feudal.”
His skill advantage is a leading indicator, not a moat
Justicz refuses to cast himself as an elite. He says he is not one of the world’s best hackers but has had some bug-bounty success, and he has seen a massive uplift from the models. His only edge is taste — knowing which targets are worth aiming a model at — and he expects that edge to evaporate fast.
“I’ve seen just a massive uplift in what I can do because of these models. And I think that marginal difference due to my skills is just going to quickly diminish to the point where if you’re completely unskilled, you’ll be able to do the same thing,” he said. “I have a little bit of taste in being able to aim the models at things that I think are worth looking at, but what kind of moat is that? I don’t think that’s going to last very long.”
He describes himself as a canary in the coal mine. A couple of months before the interview, the most skilled hackers were the ones getting extra results from AI; at the time of the interview it was people like him; soon it will be ordinary computer users. He is “pretty confident” of that progression.
The labs are tightening access — but the horse may be out of the barn
If AI makes finding bugs this easy, why hasn’t there been a wave of cyberattacks on ordinary people? Justicz offers three reasons, and only one of them is reassuring.
First, the frontier labs are getting better at refusing egregious vulnerability-hunting requests. He used Daybreak Blue, which he describes as the easiest-to-access tier with elevated security permissions that OpenAI offers, and says the same requests that found the APT bug no longer work since the disclosure. He says he hasn’t been able to get Claude to do anything “super useful” for him. Second, the number of actors trying to cause harm may itself be a rate limit — ransomware crews are still busy running ransomware. Third, and in his view most important, “I think the tools just aren’t in enough people’s hands to have caused major incidents. But I think we’ll see them. I think it’s kind of just a matter of time.”
That timeline is short. His forecast is that a wave of “really ridiculous bugs” is about to surface and will get worse over the next few months.
The access question is where the story gets uncomfortable. Justicz also tested an unrestricted open-weight model, GLM 5.3, served through a startup called Obliteration that strips out its safety restrictions. He calls it “a bit dumber” than the GPT-5.6 models he used but “certainly powerful enough to be dangerous” and capable of finding shallower bugs — for about $100.
| Model / access route | Justicz’s assessment |
|---|---|
| GPT-5.6 via Daybreak Blue (OpenAI’s elevated-security tier) | Found the APT bug; the same requests stopped working after disclosure |
| Claude (Anthropic) | He could not get it to do anything “super useful” for him |
| GLM 5.3 via Obliteration (unrestricted) | Dumber than GPT-5.6 but dangerous; finds shallower bugs for ~$100 |
On whether services like Obliteration are net good, he splits his answer by time horizon. In the short term he sees them as good, because they let defenders audit code faster — and he notes second-order effects, like his own use raising awareness of the problem. He even messaged the company on LinkedIn to thank it. In the long term, though, he calls it “probably net bad to be providing kind of misaligned AI as a service,” because it normalizes access to models willing to do harmful things.
What defenders should do now — and why it’s a race
Justicz’s advice to package maintainers is blunt: sign up for the labs’ security programs — he names Daybreak Blue and what he recalls as Anthropic’s “cyber verification program” — and aim the models at your own code. He calls it “table stakes now.” For more aggressive auditing, spend the $100 on an unrestricted model and audit with that.
The structural problem underneath all of this is coverage. Popular devices may keep a high bar, but the surface area of modern life is too large for anyone to audit all of it, so security depends on who points a model at a given piece of code first. That makes AI-assisted bug hunting a first-mover race: the defender who audits their own code finds the flaw before an attacker does, and the attacker who looks first gets a window that human patch schedules — five to six weeks in APT’s case — leave wide open.
What follows is a race with an unstable equilibrium. The same access that lets defenders audit faster also lowers the skill floor for attackers, and the labs’ tightening of access — which Justicz observes directly — slows both sides at once. The unresolved tension is that nobody can audit everything, the models keep getting better, and patching still moves at the speed of vacation schedules.
For investors, the read-through is less about any single stock than about where risk now sits. Software that has never been audited with AI tools is an unpriced liability — for the companies that ship it, the platforms that depend on it, and the insurers who cover them. The defensive winners will be the labs’ security-access programs, the boutiques selling AI-assisted audits, and the vendors whose patch pipelines can actually move at machine speed. The losers are everyone who assumes the code they rely on has been checked — because, as Justicz’s afternoon on an Android phone shows, it probably hasn’t.