Abstract:
OpenAI recently announced a security research result that has attracted widespread attention in the industry. The company said that one of its upcoming cybersecurity-specific artificial intelligence models successfully discovered 948 local privilege escalation vulnerabilities in the Linux kernel. Once exploited, these vulnerabilities may allow ordinary local users to obtain the highest level of Root privileges on the system.
The Linux kernel is one of the most important software infrastructures in the world and is widely used in devices and systems such as Android smartphones, cloud computing platforms, data center servers, and supercomputers. Due to the extremely large size of the code, finding potential security vulnerabilities has always been a time-consuming and complex task.
OpenAI said that this research does not simply require the AI model to find vulnerabilities, but builds a complete multi-stage automated security research process to carry out industrial-scale audit work on the Linux kernel. The entire system is completed collaboratively by multiple dedicated AI agents, and everything from target screening, vulnerability analysis, vulnerability verification to exploitation testing and patch generation is automated.
In the first stage, the AI agent called "Scout" first analyzes the kernel code base and filters out functional modules and files that are accessible to ordinary users. In the end, the system identified about 2.8 million lines of key code from more than 40 million lines of code as audit targets, accounting for about 7% of the entire Linux kernel code size. A total of 5,034 potential targets were selected for in-depth inspection.
Subsequently, the "Analyst" agent conducted security analysis on these codes and found 2,308 potential vulnerability candidates within 12 hours. Since then, the "Triage" agent has reproduced and verified these findings in an isolated virtual machine environment, successfully confirming 1,724 real vulnerabilities in about 30 hours.
After completing the verification, the AI system further evaluates the exploitability of these vulnerabilities. Finally, 291 proof-of-concept programs for information leakage vulnerabilities were generated, as well as 1169 effective attack samples capable of achieving local privilege escalation. After analyzing and classifying duplicates, the research team confirmed that there were 948 independent vulnerabilities.
OpenAI stated that these attack samples were tested in a standard desktop system environment with modern Linux security protection mechanisms enabled, including mainstream protection technologies such as KASLR, SMEP and SMAP. This means that the relevant vulnerabilities can still be exploited even in environments with common security protection measures.
What is even more concerning is that the researchers claimed that the AI system discovered and used at least 10 previously unrecorded Linux vulnerability exploitation techniques during the analysis process. These include new kernel object spraying methods, memory paging techniques, and multiple data attacks that enable privilege escalation without traditional code execution. For security reasons, OpenAI does not disclose the specific details of these technologies.
Data shows that the entire project consumed a total of approximately US$1.21 million in API computing resources, and the average cost of each discovery of an available privilege escalation vulnerability was approximately US$1,279. OpenAI pointed out that based on previous vulnerability reward program standards in the security industry, the total potential bounty value corresponding to these 948 vulnerabilities may reach between US$18.9 million and US$66.3 million.
During the research period, OpenAI has begun to submit vulnerability reports and repair plans to the Linux maintenance community. The company said that during the 10-day coordinated disclosure process, 61 privilege escalation vulnerabilities have been formally patched, 43 vulnerabilities have entered the patch testing stage, and another 299 vulnerabilities are in the public discussion and review process.
This achievement also demonstrates the increasing capabilities of artificial intelligence in the field of network security. In June this year, OpenAI announced that its GPT-5.5 Cyber model discovered and verified 24 Linux privilege escalation vulnerabilities; in another test conducted in July, the company's model discovered 166 independent vulnerabilities. In comparison, the number of 948 vulnerabilities discovered in this latest experiment has increased by more than five times, even though the Linux kernel has undergone extensive security hardening in the past few months.
OpenAI believes that vulnerability discovery work will become increasingly large-scale and automated in the future. Vulnerability mining tasks that once took security researchers weeks or even months to complete are now gradually evolving into standardized processes run continuously by artificial intelligence systems. However, the company also emphasizes that human researchers are still essential because key links such as vulnerability identification, impact assessment, and liability disclosure still require professional participation in review.
As the capabilities of AI models continue to improve, the network security industry is entering a new stage. On the one hand, defenders can use artificial intelligence to discover and patch vulnerabilities at an unprecedented speed; on the other hand, this technology also means that attackers may have access to more powerful automated attack tools in the future. How to strike a balance between improving defense efficiency and preventing abuse risks is becoming an important issue in the entire network security field.
Comments