OpenAI Pipeline Generates 948 Linux Local Privilege Escalation Exploits

According to ChainCatcher citing OpenAI’s website, the company built an autonomous security research pipeline for vulnerability discovery, dynamic validation, exploitability assessment and patch generation. In a run focused on an upcoming cybersecurity model, it scanned Linux kernel targets and generated 948 exploits for vulnerabilities enabling local privilege escalation (LPE) on common Linux distributions. The run cost about $1.213 million in API usage, or approximately $1,279 per LPE exploit. The pipeline identified and analyzed 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities and produced 291 information-leak proof-of-concepts (PoCs). Its Scout agent selected about 5,034 audit targets, covering roughly 2.8 million lines of code, or about 7% of the kernel; the Analyst agent generated candidate findings in about 12 hours. OpenAI said it prioritized critical vulnerability reports in line with Linux community guidance and is working with Patch the Planet partners on remaining reports. In adapted kernelCTF environments, the pipeline also produced 25 information-leak PoCs and 21 LPEs. OpenAI said a sample of 166 exploits showed the agents used at least 10 techniques it considered relatively new to Linux exploitation. About 10 days after scanning, more than 100 LPEs had been patched or entered staging, while roughly 300 others were under public discussion.