Technology news and discussion on TalkFuse.
OpenAI Found 948 Linux Security Flaws—And Figured Out How to Exploit Them
OpenAI says autonomous AI agents identified 948 distinct vulnerabilities in the Linux kernel and created working exploits and proposed fixes for review. The findings matter because the kernel underpins cloud servers, Android devices and other critical systems, while the work suggests AI can make advanced vulnerability research and exploitation faster and cheaper.
The October experiment scanned about 2.8 million lines of code, roughly 7% of the kernel, and cost $1,213,430 in API credits, or around $1,279 per flaw. The vulnerabilities could let someone with limited local access gain root privileges; they did not provide remote access by themselves. OpenAI says its agents used at least 10 exploitation techniques unfamiliar to consulted researchers. The company is restricting access to its stronger cyber tools and offers approved defenders access through its Daybreak Red initiative.
In short
- AI agents found 948 distinct Linux kernel flaws.
- The October experiment cost about $1.2 million.
- The flaws could let local users gain root access.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The experiment suggests autonomous agents could help defenders find and repair kernel vulnerabilities at a scale and speed that would be difficult for human researchers alone. Because the reported flaws required some local access and OpenAI says it shared proposed fixes for review, the work may strengthen security if findings reach maintainers promptly and tools remain in responsible hands. The high cost also indicates that this capability is not yet cheap to deploy widely.
The case against
Finding working exploits as well as vulnerabilities creates risks: techniques that help defenders assess flaws could also make it easier for attackers to turn them into privilege-escalation tools. Even with restricted access, the discovery of hundreds of flaws and techniques unfamiliar to consulted researchers raises questions about disclosure, patching capacity and whether powerful systems can be reliably contained. The cost may fall as the technology improves, potentially broadening access to capabilities that are currently difficult to obtain.