Imagine initiating an AI system one time, and then getting billed $1,213,430 when the run finishes. No really, OpenAI wants you to imagine it.
The company has published an intriguing blog post about “an autonomous vulnerability discovery, exploitation, and patching pipeline” that spawns countless agents that hunt down a massive number of software vulnerabilities, prove they’re scary, and create the code that would eliminate them. It sounds a little like a giant, multi-armed, automated colonoscopy for a highly complex codebase, not just poking around for dangerous polyps, but also essentially eliminating them.
OpenAI says this particular system, designed to scan the Linux kernel—which is the bedrock on which Android phones and much of the internet are built— found 2,308 potential vulnerabilities. After some further paring down, it then sorted out the worst of these potential problems, running them on a virtual machine to prove they can be used to fully take control of a system. In 948 cases, OpenAI says the vulnerabilities were proven to be truly dangerous.
Patch-writing agents then wrote the 948 necessary patches, but didn’t actually edit the codebase. The patches were sent for approval from humans first.
For the AI tokens consumed in all the “thinking” that goes into one single, solitary run of this giant AI workflow, OpenAI says if the client were to be billed, the API cost would be $1,213,430. We’re meant to think of it this way: By OpenAI’s math, $1,213,430 in tokens comes out to $1,279 per validated exploit. This kind of work is usually done by paying white-hat hackers $20,000 to $70,000 in bug bounties. “Applying those historical bounty amounts to the 948 exploits produces a hypothetical valuation of $18.9M—$66.3M, approximately 16x to 55x our pipeline’s cost.” So by that logic, $1,213,430 is a bargain. In theory.
OpenAI isn’t saying this is totally new. It did something similar on a smaller scale in June as part of an initiative called “Patch the Planet.” Vulnerability discovery is a big part of what frontier AI labs are selling lately. In fact, Google last year claimed to have used an automated vulnerability-hunting tool called Big Sleep to stop an attack in progress.