OpenAI's AI Discovered 948 Vulnerabilities in Linux

OpenAI reported that its experimental artificial intelligence system identified 948 unique vulnerabilities in the Linux kernel, allowing a user with limited privileges to gain administrator rights. The results were presented on November 4. The study was conducted in a controlled environment and does not indicate a breach of real cryptocurrency platforms.

During the inspection in mid-October, the system detected 2,308 potential issues in the code, of which 1,724 were reproduced during testing. The AI then prepared 1,169 working methods for privilege escalation. After analyzing recurring variants, researchers identified 948 unique vulnerabilities and prepared proposed fixes for them.

The tests were conducted on virtual machines with standard Linux security tools. The discovered errors allowed for privilege escalation by an already authorized user, rather than penetrating an arbitrary computer via the internet. The results were verified by specialists, after which vulnerability reports and fix options began to be passed on to kernel developers.

The cost of the experiment amounted to $1.21 million in terms of software model usage, or about $1,279 per unique vulnerability with a confirmed exploitation method. OpenAI estimated the conditional cost of such a number of findings at $18.9–66.3 million based on previous rewards in cybersecurity competitions. This is an estimated valuation, not actual payments received.

Why the results are important for the crypto industry

Linux is used in blockchain infrastructure, including on servers and Ethereum network nodes. A vulnerability in the operating system of an individual node can pose a risk to its owner or the services it supports. However, the presence of a bug in Linux does not in itself mean a compromise of the blockchain or the ability to alter its transaction history.

Polygon Labs' Chief Technical Officer Mudit Gupta believes that the distributed architecture of blockchains and the diversity of infrastructure enhance the resilience of networks to individual failures. However, decentralization does not eliminate vulnerabilities in specific servers and software components.

OpenAI emphasizes the protective aim of the research – to detect errors before they are exploited by attackers. Linux developers are considering the proposed fixes, but information on the adoption of all 948 fixes is not available. The provided metrics are based on OpenAI's own tests, and the model used has not yet been released publicly.