OpenAI built an AI pipeline to find, exploit and patch Linux flaws - CSO Online
By Google News AI ·
OpenAI has developed an autonomous AI pipeline that can identify software vulnerabilities, develop working exploits to validate their impact and generate patches for human review. In an October experiment targeting the Linux kernel, the pipeline created exploits for 948 distinct local privilege-escalation (LPE) vulnerabilities at a total API cost of $1.2 million, the company said in a November 4 research report, “A thousand fewer paths to root.” The system automates vulnerability discovery, dynamic validation, exploit development and patch generation. Human researchers still review the root-cause analysis, proof-of-concept exploits and proposed fixes before findings are reported to maintainers, OpenAI said. The research builds on OpenAI's Patch the Planet initiative. Announcing the project in June as part of its Daybreak cybersecurity effort, the company said GPT-5.5 Cyber had identified Linux kernel vulnerabilities and developed 24 LPE exploits. The latest experiment extends that work into a pipeline covering discovery, exploitation and patch generation, the report added. AI changes the economics of vulnerability research The October campaign cost $1,213,430 in API credits, averaging $1,279 per distinct LPE exploit created, OpenAI said. OpenAI compared its research expenditure with historical Linux kernel vulnerability bounty rewards offered by the Pwn2Own and TyphoonPWN hacking competitions, which have paid $20,000 to $70,000 for LPE exploits. Based on those numbers, OpenAI estimated the value of the 948 exploits it created at between $18.9 million and $66.3 million, or 16 to 55 times the pipeline's cost. The comparison does not represent actual bounty payouts or establish that every finding would qualify for those rewards. The latest campaign identified five times…
Originally published by Google News AI
