OpenAI sets AI agents loose on the Linux kernel and counts 948 working attacks for 1.2 million dollars

OpenAI has described how an automated pipeline of AI agents searched the latest Linux kernel in October for flaws that let an ordinary user gain full administrator rights. After duplicates were merged, 948 distinct vulnerabilities with a working attack remained, Help Net Security reports. The bill for API usage came to 1,213,430 dollars, or about 1,279 dollars per attack.

The agents examined about 7 percent of the code and found 2,308 possible bugs in twelve hours, of which 1,724 could be reproduced. In a sample of 166 attacks they used ten techniques that the researchers said were new. OpenAI calculates that such attacks would together be worth 18.9 to 66.3 million dollars at hacking contests such as Pwn2Own, although CSO Online notes this is a comparison rather than actual payouts. The company is withholding technical details for safety reasons.

Human researchers review the analyses and proposed patches before they go to the kernel developers. Ten days later, 61 flaws had been fixed in the official kernel, 43 had a patch in preparation and 299 were under public discussion. An early test showed that 20 of 200 apparently successful attacks exploited a different flaw than the one assigned, after which OpenAI added an extra check. An IDC analyst told CSO Online that the biggest risk is the time it takes for fixes to actually reach companies' Linux versions.