OpenAI Agents Found 948 Root Exploits in the Linux Kernel for $1.2M
Artificial intelligence just went from writing mediocre poetry to autonomously tearing apart the bedrock of modern internet infrastructure. The wild part? It didn't just spot flaws — it built weapons to prove them.
A swarm of specialized autonomous models was turned loose on about 2.8 million lines of code, covering roughly seven percent of the active Linux kernel. Within the first twelve hours of scanning, the bots flagged over two thousand suspicious locations. Rather than dumping raw hunks of theoretical garbage on human maintainers, the system had to verify each claim inside an isolated virtual machine running KASAN memory diagnostics, successfully confirming 1,724 actual vulnerabilities.
Finding a glitch is polite academic research, but weaponizing it is where things got spicy. The agents systematically generated 1,169 working root exploits across 948 unique vulnerabilities on a standard, fully defended desktop system with protections like SMEP, SMAP, and KASLR explicitly turned on. Even hardened security defenses were treated like casual speed bumps by algorithmic trial and error.
When thrown into Google's dedicated kernelCTF proving grounds, the bots walked away with 21 working privilege escalation exploits and 25 memory leakage proofs. The machines even invented at least ten completely novel exploitation techniques involving uncharted memory layout tricks that human security researchers had never documented before, prompting company engineers to keep the exact tactical playbooks classified.
Early iterations were not without pure algorithmic comedy, as several bots claimed victory on an assigned flaw only for audits to reveal they had accidentally rooted the box using an entirely different, unassigned bug they stumbled upon mid-hack. The full automated rampage cost exactly $1,213,430 in raw API calls, averaging out to roughly $1,279 per weaponized privilege escalation path before the team shipped hundreds of generated patches upstream to human maintainers.
The era of humans slowly fuzzing operating systems with hand-crafted scripts has officially run into an automated meat-grinder that builds zero-days before lunch. When a digital agent can drop a thousand privilege escalation exploits for pocket change, the line between automated defense and automated catastrophe comes down entirely to who owns the compute budget.
Source: OpenAI
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.