In research published on 4 November, OpenAI said an automated scan of the Linux kernel produced 948 working local privilege-escalation exploits and candidate patches for maintainer review. Such an exploit could let someone with limited access to a computer gain root access, which gives broad control over the system.
OpenAI’s pipeline searched kernel code for possible flaws, tested them in an isolated environment, built exploits to check their impact and generated proposed fixes. In its mid-October run, it examined 2,308 candidate findings and dynamically reproduced 1,724 vulnerabilities. The 948 exploits worked against a stock desktop operating system running in virtual machines, according to OpenAI. The run cost $1,213,430 in API credits, or $1,279 per privilege-escalation exploit. Human researchers reviewed the output before reporting vulnerabilities with patches.
Updating an operating system could close one of these routes to root access if a proposed patch were accepted and made available. The exploits and candidate patches alone would not change the software already installed.
OpenAI said that, during 10 days of its scan, it observed more than 100 Linux privilege-escalation flaws patched or given staging patches by other contributors.
