OpenAI on X: "Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline. In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost… / X
OpenAI on X: "Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline. In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million."
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline. In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline. In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
The pipeline finds security-relevant code, scans for vulnerabilities, reproduces them in isolated environments, tests whether they can be exploited, and generates candidate patches. Human researchers review the results before reporting vulnerabilities and propose fixes toShow more
The run reproduced 1,724 vulnerabilities. It produced proofs of concept for 291 information leaks and working exploits for 948 distinct local privilege escalation vulnerabilities. Those exploits worked on a stock Linux desktop configuration with standard security protectionsShow more
The full run cost $1,213,430 in API credits—about $1,279 per distinct local privilege escalation vulnerability. For context, applying historical Pwn2Own and TyphoonPWN bounty rates gives a hypothetical value of $18.9M–$66.3M. This demonstrates the relative efficacy of using AIShow more
The agents also discovered and used at least 10 Linux exploitation techniques that, to the best of our knowledge and all of the experts that we consulted, are novel. This suggests frontier LLMs can discover and patch new approaches to exploitation, beyond simply applying knownShow more
Our goal is to help defenders find and fix vulnerabilities before attackers can use them. We’re working with Linux maintainers and Patch the Planet partners on reports and patches.