OpenAI Unveils AI System That Found 948 Security Vulnerabilities in Linux

OpenAI has released information about an artificial intelligence (AI) system that independently finds and checks security vulnerabilities in the Linux kernel and develops patches, or fixes, for them. According to the company’s calculations, the API cost of the tokens used each time the system runs would be $1,213,430 (approximately 2,062,830 manats). Tokens are small units that an AI model processes when handling text and code. The Linux kernel forms the foundation of Android phones and a large part of the internet’s infrastructure.

During the initial scan, the system detected 2,308 potential security vulnerabilities. Vulnerabilities that appeared serious were then selected and tested in a virtual computer environment. The goal was to determine whether they could be exploited to gain full control of the system. As a result, 948 vulnerabilities were confirmed to pose a genuine threat.

During this process, numerous AI programs simultaneously examined the code, tested vulnerabilities and developed fixes. Separate patch code was written for each of the 948 vulnerabilities confirmed to be dangerous. However, these changes were not added directly to the Linux code. Before being applied, the patches were submitted to human experts for review and approval.

According to the company’s calculations, the token cost for each confirmed exploit was $1,279 (approximately 2,170 manats). By comparison, white-hat hackers who find security vulnerabilities and notify companies typically receive rewards ranging from $20,000 (approximately 34,000 manats) to $70,000 (approximately 119,000 manats). When these amounts are calculated for 948 vulnerabilities, the theoretical value reaches between $18.9 million (approximately 32.1 million manats) and $66.3 million (approximately 112.7 million manats). This is 16 to 55 times higher than the system’s estimated cost.

This is not the first time OpenAI has tested such an approach. In June, the company used a similar system on a smaller scale as part of the Patch the Planet initiative. Google also announced last year that its automated vulnerability-search tool called Big Sleep had stopped an ongoing attack. These projects show that AI companies are paying more attention to automatically finding security vulnerabilities in software.