In brief – OpenAI says its autonomous cybersecurity system identified 948 distinct Linux privilege-escalation vulnerabilities and developed working exploits. – The research cost $1.21 million in API credits, averaging $1,279 per vulnerability, with a more capable AI model…
nding over five times as many flaws as an earlier version. – The system also generated candidate patches, but human review and software maintainers remain responsible for validating and implementing fixes. OpenAI says its autonomous security agents discovered 948 distinct vulnerabilities in the Linux kernel, developed working exploits and drafted fixes for review—all for roughly $1.2 million in API credits. “We chose Linux to study how effectively frontier models could find vulnerabilities and demonstrate their security impact in a codebase of this scale and importance,” OpenAI said in results published Wednesday
The Linux kernel powers cloud servers, Android devices and much of the world’s critical computing infrastructure. The flaws identified in OpenAI’s experiment were local privilege-escalation vulnerabilities: An attacker would first need limited access to a vulnerable machine, but could then potentially obtain root privileges and take full control. 948 flaws, 1,169 working exploits OpenAI’s agents scanned about 2.8 million lines of kernel code, or roughly 7% of the project. “Our prototype identified and analyzed 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 local privilege escalation (LPE) exploits that could allow an unprivileged local user to gain root access” OpenAI said. After grouping exploits by their underlying cause and proposed fix, researchers counted 948 distinct flaws.
The October run cost $1,213,430 in API credits, equivalent to around $1,279 per vulnerability. OpenAI compared that with historical $20,000-to-$70,000 payouts for Linux privilege-escalation exploits at hacking competitions, suggesting a hypothetical value…