Under Linux, AI looks for vulnerabilities and prepares fixes

An OpenAI campaign reports 948 vulnerabilities that allow users to become administrators under Linux. Fixes are proposed to maintainers after human review.

A non-privileged account obtaining control of a machine: that is the risk demonstrated in 948 distinct cases by a Linux kernel audit campaign, according to OpenAI. Agents searched for flaws, tried to reproduce them, and developed programs capable of confirming their severity. They also prepared patches, which human researchers review before submission to maintainers.

The publication devoted to this research describes a campaign conducted in mid-October with a specialized cybersecurity model still to come. The 948 cases correspond to local privilege escalations: a user must already have access to the machine in order to obtain administrator, or “root,” rights. The figure therefore does not mean 948 attacks that can be carried out directly from the Internet. Thousands of alerts, then proof of their severity

The work begins with selecting the code to examine. Agents identify 5,034 audit targets, representing about 2.8 million lines, or 7% of the kernel according to the report. They prioritize components accessible to a low-privileged user and of security interest. Other agents analyze these areas and produce 2,308 candidate reports after deduplication.

An alert resulting from code review is not yet a proven vulnerability. The agents therefore attempt to reproduce the reported behaviors in isolated virtual machines, using a memory error detection tool. The team reports 1,724 vulnerabilities reproduced at this stage. The remaining cases also include problems that are difficult to trigger within the allotted time; they are not all classified as false positives.

The process then distinguishes the possible consequences. The tests result in 291 proof-of-information-leakage cases and 1,169 functional privilege-escalation programs. Analysis of variants reduces the latter to 948 distinct flaws, associated with as many proposed patches. This difference explains why the number of exploit programs exceeds that of the retained vulnerabilities.

According to the researchers, the privilege-escalation demonstrations are carried out on a standard Linux desktop configuration, with its usual protections enabled. The environment for this stage is distinct from the one used to identify memory errors. The claimed result thus concerns exploitability under the tested conditions. Gaining administrator rights is not enough to validate the test

An incident reported by the team shows why verifying the result remains essential. In an initial test, the system had counted 200 successful privilege escalations. Human review revealed that, in 20 cases, the agents had used another, still unknown flaw instead of the one they were supposed to examine.

The apparent objective was achieved: the program obtained administrator rights. But it did not prove the exploitability of the assigned issue. The researchers explain that they then tightened the constraints and added an independent check to confirm that each final program did indeed use the expected vulnerability. This verification covers the path taken, in addition to the result obtained.

The publication also reports ten exploitation techniques judged novel by the team, after review of a sample of 166 programs. The external specialists consulted were also unfamiliar with them, according to OpenAI. This assessment of novelty remains attributed to the researchers; the full details of these techniques are not published in the document. About $1,280 in API credits per distinct flaw

The announced cost for the main campaign reaches $1,213,430 in API credits. Spread across the 948 privilege-escalation flaws, this total represents about $1,280 per case. This is the cost of model calls for the entire campaign, not just the development of the successful programs. This scope does not constitute a complete accounting of research work, infrastructure, and human review.

The expense depends heavily on how difficult the attempts are. The report indicates that unsuccessful exploitation attempts cost more, on average, than those that succeeded. An agent can pursue a difficult lead for a long time before giving up. The ability to decide when to stop an attempt therefore affects the cost of automation.

To give an economic order of magnitude, the company applies historical bounty amounts from Pwn2Own and TyphoonPWN to the 948 cases. It arrives at a hypothetical valuation of roughly $19 million to $66 million. This projection assumes those bounties are applied to all cases; it does not correspond to rewards paid out or revenue earned. Patches remain a maintenance task

Patch production follows the demonstration of the flaw. The dossier intended for researchers includes the root-cause analysis, a minimal program reproducing the problem, a proposed fix, and the elements needed to assess its severity. Humans review these results before the reports, coordinated with partners in the Patch the Planet initiative.

The first generated fixes could block the tested case while still being incomplete or poorly suited to the project. The authors cite superfluous code, possible performance impacts, and variants of the problem that were insufficiently examined. They report improvement after several iterations on patch generation. An automatically produced fix must therefore still be examined for its scope and its integration into the existing code.

The kernel continued to evolve during the campaign. At the end of ten days of analysis, the team observed 61 privilege-escalation flaws already fixed in the main project, 43 with patches in preparation, and 299 subject to public reports or discussions. These parallel efforts by the community make it necessary to recheck the state of the code before submitting the reports.