OpenAI yesterday published research showing how much AI is already changing security. According to the company, an autonomous system of AI agents built on a not-yet-released cyber model found 948 distinct vulnerabilities in the Linux kernel and built a working exploit for each that gives an attacker root privileges on the machine. The company says the agents also discovered at least ten new Linux exploitation techniques.
The process worked like a funnel. 'Scout' agents picked 5,034 audit targets, about 2.8 million lines of code or roughly 7% of the kernel. 'Analyst' agents produced 2,308 candidate findings in 12 hours, of which 1,724 were confirmed. In the end 1,169 working exploits were built, and after removing duplicates 948 separate vulnerabilities remained. The whole run, in mid-October, cost about $1.2 million in compute.
To be precise, 948 is not 948 already-fixed flaws. According to OpenAI, within ten days 61 had been patched in the upstream kernel, and the company is working with kernel maintainers and partners in a program called Patch the Planet to fix the rest. It is not publishing the exploit code. These are local privilege escalation bugs: an attacker first needs some access to a machine, but can then take it over completely.
The research cuts both ways. It shows AI tools can find and fix flaws at a pace no human team can match. But if such models reach the wrong hands, they could produce attacks at the same pace. Linux maintainers are already dealing this year with an unprecedented wave of bug reports, many found with AI. For organizations, the takeaway is clear: patch Linux systems promptly, because the pace of discovery will only rise.
