OpenAI’s automated pipeline scanned the Linux kernel and produced 948 working privilege-escalation exploits with candidate patches for about $1.2M in API costs
OpenAI published research on 4 November describing an automated pipeline that finds, validates and patches vulnerabilities. According to AI Affairs, a mid-October run against the Linux kernel examined 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities and produced 948 working local privilege-escalation exploits that let an unprivileged local user gain root; the run cost $1,213,430 in API credits, or $1,279 per exploit.
As OpenAI describes it, the pipeline searches kernel code for likely flaws, triggers them in an isolated environment to confirm them, builds exploits to check their impact and then generates proposed fixes. The 948 exploits were validated against a stock desktop operating system running in virtual machines. Human security researchers reviewed the output before the vulnerabilities and patches were reported to Linux maintainers.
The exploits and candidate patches do not change systems already installed; that only happens once patches are accepted and shipped in updates. OpenAI also said that during 10 days of its scan it saw more than 100 Linux privilege-escalation flaws patched or given staging patches by other contributors.
All figures are OpenAI’s own. The openai.com post returned 403 to our direct fetch, so these details rely on AI Affairs’ summary.