started · updated
OpenAI develops autonomous AI pipeline to find and patch Linux vulnerabilities
OpenAI has unveiled an autonomous cybersecurity research pipeline that utilizes an unreleased AI model to identify, validate, and generate patches for software vulnerabilities. In a recent 30-hour experimental run, the system analyzed approximately 2.8 million lines of Linux kernel code, identifying 2,308 candidate findings and successfully validating 948 distinct local privilege escalation (LPE) vulnerabilities.
The pipeline employs a multi-agent architecture consisting of Scout, Analyst, Triage, and Exploit modules. The system was able to bypass various kernel hardening protections and developed at least 10 previously undocumented exploitation techniques. While the AI generated candidate patches for the identified flaws, these results are subject to human review before being submitted to Linux maintainers.
The research campaign incurred an API cost of approximately $1.21 million, averaging $1,279 per verified vulnerability. OpenAI noted that this cost is significantly lower than the hypothetical value of bug bounties for such flaws, which could range from $18.9 million to $66.3 million. Additionally, the company reported that its GPT-6 Cyber model identified 81 high-severity vulnerabilities in Mozilla Firefox, which Mozilla has since begun addressing.
Entities
Debian Project · GPT-6 Cyber · Linux · Linux · Mozilla · Mozilla Firefox · OpenAI · Ubuntu
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 5 SOURCES] The system scanned approximately 2.8 million lines of Linux kernel code. dev.to · www.computerbase.de · interestingengineering.com · www.newsmobile.in · www.indiekings.com
- [● 6 SOURCES] The AI system discovered at least 10 novel Linux exploitation techniques. dev.to · www.clubic.com · interestingengineering.com · www.itnews.com.au · www.newsmobile.in · +1 more
- [● 9 SOURCES] OpenAI's autonomous pipeline identified 948 distinct Linux kernel local privilege escalation vulnerabilities. dev.to · gigazine.net · www.clubic.com · www.computerbase.de · interestingengineering.com · +4 more
- [● 3 SOURCES] The average cost per verified LPE exploit was approximately $1,279. gigazine.net · www.newsmobile.in · www.technice.com.tw
- [● 2 SOURCES] The pipeline generated 1,169 working local privilege escalation exploits. interestingengineering.com · www.indiekings.com
- [● 4 SOURCES] GPT-6 Cyber identified 81 high-severity vulnerabilities in Mozilla Firefox. gigazine.net · www.theregister.com · techgenyz.com · smartechdaily.com
- [● 8 SOURCES] The automated research run cost approximately $1.21 million in API credits. dev.to · gigazine.net · www.computerbase.de · interestingengineering.com · www.itnews.com.au · +3 more
- [● 4 SOURCES] The system identified 2,308 candidate findings within 12 hours. www.computerbase.de · interestingengineering.com · www.newsmobile.in · www.indiekings.com