A single OpenAI experiment uncovers 948 exploitable holes in the Linux kernel
The experiment cost about 1.2 million dollars in compute according to OpenAI, but the figures have not been independently checked and most fixes have yet to land in the kernel.
OpenAI has turned a prototype automated pipeline loose on the Linux kernel and says it found 948 separate vulnerabilities for which a working attack exists that gives an ordinary user root privileges. SecurityOnline reports this based on a blog post by the company. The pipeline ran on a cyber model that has not yet been released and examined about 2.8 million lines of code in October, roughly 7 percent of the kernel.
According to SecurityOnline, the scan produced 2,308 possible problems, of which 1,724 were confirmed as real vulnerabilities. The total cost came to about 1.21 million dollars, or around 1,280 dollars per unique flaw with a working attack. In a sample, analysts also found at least ten new techniques for attacking Linux. Patches proposed by the pipeline are first reviewed by human researchers before being sent to the kernel maintainers.
Startup Fortune adds caveats: the 948 cases are validated attacks with a proposed patch, which does not mean 948 fixes are already in the kernel. The costs and results also come from OpenAI's own accounting. OpenAI is working with the kernel maintainers and partners to close the holes and is not publishing the attack code.