AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research
OpenAI’s autonomous AI pipeline generated working root exploits for 948 unique Linux kernel vulnerabilities in a single run that cost $1.2 million in API credits.
The autonomous pipeline, powered by an unreleased cyber model, first narrowed the kernel down to security-relevant areas that low-privileged users can reach. It then flagged 2,308 potential bugs and confirmed 1,724 of them.
Exploits were tested on virtual machines running an unmodified desktop Linux setup with common protections such as KASLR, SMEP and SMAP turned on. The agents came up with 1,169 working local privilege escalation (LPE) exploits, along with 291 proofs of concept for information leaks.
The $1,213,430 bill comes to roughly $1,279 apiece for the 948 exploits. OpenAI notes that the October scan uncovered more than five times as many new LPEs as an earlier scan in late July, which yielded 166 unique LPEs at a cost of $513,690.
To the best of our knowledge, the agents in this pipeline discovered and used at least 10 novel Linux exploitation techniques.
Pipeline Performance
The mid-October scan targeted the most recent code in the kernel’s master branch. Before anything went to kernel maintainers, its security researchers checked the exploits and fixes, along with the severity the system proposed.
OpenAI puts the haul in perspective: at the $20,000 and $70,000 that Pwn2Own and TyphoonPWN have historically paid for Linux kernel privilege escalation exploits, the 948 bugs would be worth $18.9 million to $66.3 million, or 16 to 55 times what the scan cost.
The company also pointed the pipeline at an adapted version of Google’s kernelCTF, whose target kernel is hardened and exposes less attack surface. Over 112 hours and about $33,000 in API credits, it delivered 21 LPE exploits.
Bug Bounty Increase
OpenAI is increasing payouts in its Security Bug Bounty program to get more outside researchers hunting for flaws that its own testing may have missed. The company says the midpoint of its payout ranges for medium-, high-, and critical-severity bugs is now more than four times higher on average.
A researcher who reports a critical flaw in ChatGPT, Codex, the API Platform or another core product can now earn as much as $30,000. The cap for exceptional critical bugs in those products stays at $100,000, but bonuses can now push a single payout to $172,000.
OpenAI is adding bonuses for high-quality reports, a five-tier loyalty program for researchers who keep finding valid bugs, and extra multipliers for flaws reported during priority campaigns.
Next Steps
Acting on advice from the kernel community, OpenAI says it has already submitted hundreds of reports and patches for critical flaws. It will send fixes for the remaining bugs in stages, working with partners in its Patch the Planet initiative.
Within 10 days while the scan was running, we observed over 100 Linux LPEs had been patched or had staging patches from other contributors, with ~300 more being publicly discussed, OpenAI noted.
The company also warned defenders that for the near and medium term, having access to a low-privileged account on an operating system that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.
To contain the damage when a flaw does get exploited, OpenAI points to layered defenses, including sandboxing and isolation technologies such as Firecracker and gVisor.
Related
