OpenAI published a write-up on autonomous vulnerability discovery, Phoronix reports, and the headline number is big: 948 valid local privilege escalation bugs in the Linux kernel.
Numbers
- 2,308 candidates found, 1,724 dynamically reproduced, 948 working LPEs from an unprivileged user to root
- Candidate patches were generated for maintainers to review
- Cost: about $1.2 million in API credits
- GPT-5.5 Cyber found more than 5x as many novel LPEs as GPT-5.6 Sol, even after three months of kernel patches between scans
OpenAI’s take: “In a world of no unknown vulnerabilities,” we’ll need high-assurance software, smaller attack surfaces and formal verification.
My take
That’s why Torvalds says the AI fix flood belongs in the merge window. For the rest of us: keep kernels updated, and don’t give untrusted users a shell.
God Bless, and Use the Source!
