Unreleased OpenAI model finds 948 Linux vulnerabilities costing $1.2 million
The automated cybersecurity research pipeline identified unique flaws and developed exploits to gain root access during a mid-October run.
An unreleased AI model from OpenAI identified 948 unique vulnerabilities in the Linux kernel during a research run in mid-October, according to a report by India Today. The automated cybersecurity research pipeline cost over $1.2 million in API credits to complete the process.
The company stated on X that its researchers created an autonomous pipeline for discovering, exploiting, and patching cyber vulnerabilities. The goal was to assist defenders in identifying and resolving security flaws before they could be exploited by attackers.
During the run, scout agents identified 5,034 security-relevant targets across approximately 2.8 million lines of Linux kernel code. Analyst agents then produced 2,308 candidate findings within 12 hours, and the system confirmed 1,724 vulnerabilities within 30 hours.
The AI model generated 1,169 working local privilege escalation exploits, which mapped to the 948 distinct patches. OpenAI noted that the agents also discovered at least 10 Linux exploitation techniques that researchers and experts considered novel.
OpenAI said the campaign cost $1,213,430 in API credits, which it compared to hypothetical Linux kernel bounty rates valued between $18.9 million and $66.3 million. The company has sent hundreds of reports and patches to Linux kernel maintainers and is working through its Patch the Planet initiative.
