OpenAI used AI agents to analyze the Linux kernel, uncovering 948 distinct privilege-escalation vulnerabilities
The automated pipeline generated exploits, validated findings, and helped create patches for Linux maintainers
Researchers say AI is increasingly capable of finding and prioritizing serious software flaws at scale
OpenAI has spent more than a million dollars to analyze the Linux kernel code, and found thousands of vulnerabilities, including countless privilege escalation flaws that could have been quite problematic for the popular operating system. The AI company published a new in-depth report describing how it built a five-stage pipeline that helped it surface thousands of vulnerabilities, identify which ones were actually dangerous, helped create patches, and ended up securing the Linux ecosystem some more. The pipeline covered vulnerability discovery, dynamic validation, exploitability assessment, patch generation, and human review, and once it was done, it found 948 privilege escalation flaws in the Linux kernel. Guerilla marketing
“The Linux kernel underpins Android devices, cloud infrastructure, supercomputers, and other systems used by billions of people,” OpenAI said. “With more than 40 million lines of code, the kernel exposes a broad attack surface through system calls, networking, filesystems, and device drivers. We chose Linux to study how effectively frontier models could find vulnerabilities and demonstrate their security impact in a codebase of this scale and importance.” While the efforts are certainly commendable (especially the fact that the entire ordeal cost roughly $1. 21 million in API credits), the report also reads like guerilla marketing for the company’s latest cyber model. After all, the report never mentions its name, apart from the fact that it is an “upcoming cyber model” that found 900+ flaws, which is then compared to GPT 5. 5-Cyber which “developed 24 local privilege escalation exploits.” That being said, the results cannot (and should not) be ignored…