From OpenAI · · 1m 40s
A thousand fewer paths to root
OpenAI's AI pipeline finds 948 Linux kernel vulnerabilities with $1.2m cost.
In brief
OpenAI's AI pipeline finds 948 Linux kernel vulnerabilities with $1.2m cost. OpenAI's AI pipeline discovered 948 local privilege escalation vulnerabilities in Linux kernel at $1.2m cost. Originally reported by OpenAI.
New pipeline for security
OpenAI developed an autonomous vulnerability discovery, exploitation, and patching pipeline.
948 vulnerabilities found
The pipeline validated and generated patches for 948 local privilege escalation vulnerabilities in Linux.
Cost of the work
The pipeline cost $1.2 million in API credits for the run.
How it works
The pipeline identifies security-relevant parts of the kernel, scans for vulnerabilities, reproduces them, and generates patches.
Vulnerability discovery
Scout agents identified 5,034 audit targets across 2.8 million lines of code.
Analyst agents
Analyst agents produced 2,308 candidate findings within 12 hours.
Validation stage
The pipeline reproduced 1,724 vulnerabilities out of 2,308 candidate findings.
Exploitability assessment
The pipeline generated 291 information leak proofs and 948 local privilege escalation exploits.
Cost analysis
The pipeline cost $1,213,430 in API credits for the run.
Bounty comparison
Historical bounties for similar exploits range from $20,000 to $70,000.
Hypothetical value
The 948 exploits could be valued at $18.9m to $66.3m based on historical bounties.
KernelCTF results
The pipeline found 21 local privilege escalation exploits in a hardened kernel environment.
New exploitation techniques
The pipeline used 10 novel exploitation techniques for the first time.
Patch generation
The pipeline generated candidate patches for critical vulnerabilities.
Maintainers response
Over 100 vulnerabilities were patched within 10 days of the scan.
Future implications
Frontier models will likely find vulnerabilities faster and require fewer manual checks.
What matters most
OpenAI's AI pipeline discovered 948 local privilege escalation vulnerabilities in Linux kernel at $1.2m cost.
