OpenAI AI Pipeline Discovers 1,724 Linux Kernel Vulnerabilities, Builds 948 Root Exploits
OpenAI researchers disclosed results from an automated AI-driven vulnerability research pipeline that identified 1,724 real Linux kernel vulnerabilities and built 948 working local root exploits during an October 2026 scan. The system, powered by an upcoming OpenAI cyber model, scanned millions of lines of kernel code and generated patches to close nearly a thousand root-access paths. This follows earlier runs in June 2026 (GPT-5.5 Cyber, 24 exploits) and July 2026 (GPT-5.6 Sol, 166 exploits for $513,690), showing a more than fivefold increase in unique root bugs found with the newer model. The research highlights both the scaling power of AI-assisted vulnerability discovery and the growing risk that unpatched local accounts can become equivalent to root access for well-resourced attackers.
Detalhes técnicos
The pipeline used a five-stage agent architecture: Scout agents selected 5,034 reachable code targets (2.8M lines, ~7% of the kernel) for $3,426; Analyst agents produced 2,308 candidate findings for $316,549; Triage agents used KASAN-instrumented VMs to confirm 1,724 vulnerabilities (74.7% confirmation rate) for $73,330; a screening step narrowed results to 313 info-leak and 1,238 root candidates; and ExploitDev agents built exploits against hardened VMs (KASLR, SMEP, SMAP, HARDENED_USERCOPY), yielding 291 info-leak PoCs and 1,169 root exploits mapping to 948 unique bugs. Human reviewers caught a flaw where 20 of 200 early
Linha do tempo
-
OpenAI AI Pipeline Discovers 1,724 Linux Kernel Vulnerabilities, Builds 948 Root Exploits
ler a análise desta fonte ocultar
OpenAI researchers disclosed results from an automated AI-driven vulnerability research pipeline that identified 1,724 real Linux kernel vulnerabilities and built 948 working local root exploits during an October 2026 scan. The system, powered by an upcoming OpenAI cyber model, scanned millions of lines of kernel code and generated patches to close nearly a thousand root-access paths. This follows earlier runs in June 2026 (GPT-5.5 Cyber, 24 exploits) and July 2026 (GPT-5.6 Sol, 166 exploits for $513,690), showing a more than fivefold increase in unique root bugs found with the newer model. The research highlights both the scaling power of AI-assisted vulnerability discovery and the growing risk that unpatched local accounts can become equivalent to root access for well-resourced attackers.
Technical Details
The pipeline used a five-stage agent architecture: Scout agents selected 5,034 reachable code targets (2.8M lines, ~7% of the kernel) for $3,426; Analyst agents produced 2,308 candidate findings for $316,549; Triage agents used KASAN-instrumented VMs to confirm 1,724 vulnerabilities (74.7% confirmation rate) for $73,330; a screening step narrowed results to 313 info-leak and 1,238 root candidates; and ExploitDev agents built exploits against hardened VMs (KASLR, SMEP, SMAP, HARDENED_USERCOPY), yielding 291 info-leak PoCs and 1,169 root exploits mapping to 948 unique bugs. Human reviewers caught a flaw where 20 of 200 early