So this one stopped me mid-scroll. OpenAI pointed an autonomous security pipeline at the Linux kernel and it came back with 948 working root exploits. Not 948 maybe-bugs — 948 validated privilege escalation flaws, each with a patch attached. The whole run cost about $1.2 million in API credits, which works out to roughly $1,279 per exploit. For comparison, bug bounties for this kind of thing have historically paid $20k to $70k each.
The pipeline sifted through 2,308 candidate findings, reproduced 1,724 of them as real, and distilled those down to the 948. It even turned up at least 10 exploitation techniques that researchers say hadn’t been documented before. The catch, and it’s a real one: only about 61 of the 948 had actually been patched upstream about ten days later. Finding bugs at machine speed is one thing; getting them fixed is still very much a human-speed problem.
OpenAI’s own takeaway is pretty blunt — treat any unpatched system with a low-privileged account as basically root already, if the attacker is well-resourced. And they’re not publishing the exploit code; they’re working with kernel maintainers through their Patch the Planet program.
I keep going back and forth on this one. On the one hand, a tool that finds and patches bugs this fast could make everything meaningfully more secure. On the other, the same capability in the wrong hands is… well, you can finish that sentence yourself. Which side wins here — does this make us safer, or just raise the floor for everyone, attackers included?
Source: OpenAI's New Cyber AI Model Finds 948 Linux Privilege Escalation Vulnerabilities in Just 10 Days
