NewsCSO Online

    OpenAI built an AI pipeline to find, exploit and patch Linux flaws

    Share
    OpenAI has developed an autonomous AI pipeline that can identify software vulnerabilities, develop working exploits to validate their impact and generate patches for human review. In an October experiment targeting the Linux kernel, the pipeline created exploits for 948 distinct local privilege-escalation (LPE) vulnerabilities at a total API cost of $1.2 million, the company said in a November 4 research report, “ A thousand fewer paths to root .” The system automates vulnerability discovery, dynamic validation, exploit development and patch generation. Human researchers still review the root-cause analysis, proof-of-concept exploits and proposed fixes before findings are reported to maintainers, OpenAI said. The research builds on OpenAI’s Patch the Planet initiative . Announcing the project in June as part of its Daybreak cybersecurity effort, the company said GPT-5.5 Cyber had identified Linux kernel vulnerabilities and developed 24 LPE exploits. The latest experiment extends that work into a pipeline covering discovery, exploitation and patch generation, the report added. AI changes the economics of vulnerability research The October campaign cost $1,213,430 in API credits, averaging $1,279 per distinct LPE exploit created, OpenAI said. OpenAI compared its research expenditure with historical Linux kernel vulnerability bounty rewards offered by the Pwn2Own and TyphoonPWN hacking competitions, which have paid $20,000 to $70,000 for LPE exploits. Based on those numbers, OpenAI estimated the value of the 948 exploits it created at between $18.9 million and $66.3 million, or 16 to 55 times the pipeline’s cost. The comparison does not represent actual bounty payouts or establish that every finding would qualify for those rewards. The latest campaign identified five times more unique LPE vulnerabilities than an earlier experiment using GPT-5.6 Sol, despite three months of additional hardening of the Linux kernel between the scans, OpenAI said. It also reported that its agents used at least 10 novel Linux exploitation techniques based on its analysis of a sample of 166 of the exploits. The pipeline generated candidate patches for the validated vulnerabilities and used iterative testing and variant analysis to improve them, OpenAI said, adding that initial patches sometimes introduced unnecessary code changes or performance trade-offs, or failed to address related vulnerability variants. Humans still needed in the loop While the campaign was going on and before OpenAI could report its results to Linux kernel maintainers, 61 of the vulnerabilities it discovered had already been patched upstream, 43 had staging patches, and another 299 were being publicly discussed. OpenAI said it had submitted hundreds of vulnerability reports and patches to maintainers. The report did not provide a complete remediation breakdown for all 948 findings. The need to validate AI-generated exploits is another brake on reporting. During an early experiment, OpenAI found that 20 of 200 purportedly successful exploits had obtained root privileges by exploiting a different zero-day vulnerability than the one assigned for analysis. The company subsequently introduced additional checks to ensure its AI performed the assigned work. Enterprises evaluating autonomous security tools should demand reproducible exploits, accurate root-cause identification and independent validation, said Yash Kadakia, founder and CTO at Security Brigade. “Achieving a result and correctly explaining how you achieved it are two different things,” he said. Enterprise patching remains a challenge While OpenAI focused on the number of exploits it had found, that’s not the biggest threat, said Sakshi Grover, research director at IDC. “The risk is less the 948 than the length of the window between discovery and fixes reaching production,” she said. An upstream patch does not necessarily mean that the fix has reached the Linux distribution kernel running in an enterprise environment, Grover said. She recommended prioritizing multi-tenant hosts, CI/CD runners, shared bastions, container platforms and developer fleets, and seeking backport timelines from Linux distributors. Thomas Di Giacomo, chief technology and product officer at SUSE, said the company is using similar AI tools to discover and remediate vulnerabilities while working with upstream communities on disclosure and patching. “AI accelerating code analysis and bug hunting represents a fundamental shift in the threat landscape,” Di Giacomo said. He said SUSE’s enterprise Linux security approach combines multiple layers of protection with hardened runtimes for customer applications to mitigate privilege-escalation and container-escape risks. OpenAI added that it plans to extend the research to other critical software projects through Patch the Planet, working with maintainers and security partners on vulnerability discovery, validation and automated patching.

    More on OpenAI

    Other advisories

    Other news entries

    Source: https://www.csoonline.com/article/4245265/openai-built-an-ai-pipeline-to-find-exploit-and-patch-linux-flaws.html

    ID