OpenAI cyber model uncovers 948 Linux flaws in automated test

OpenAI has published research demonstrating how a dedicated cybersecurity model autonomously found, tested, and drafted fixes for 948 local privilege escalation flaws in the Linux kernel. The experiment ran across 30 hours and cost approximately 1.2 million US dollars in computing credits, which works out to roughly 1,279 US dollars per unique flaw.

The project relied on an unreleased system named GPT-6 Cyber. OpenAI set up a five-stage automated pipeline. Software agents first scanned the source code to find reachable target areas, produced candidate bugs, ran tests inside isolated machines to confirm the faults, and then generated functional root exploits along with suggested patches. Internal staff examined each exploit and proposed fix before passing them to the open-source software maintainers.

During the trial, the automated pipeline examined 2,308 candidate findings and successfully recreated 1,724 faults in a test environment. From those, the agents generated working root access demonstrations for 948 issues, along with 291 proofs of concept for data leaks. The company noted that the system independently applied at least 10 attack techniques that were previously undocumented.

Earlier testing with older models in July yielded fewer issues at more than double the cost per flaw. OpenAI stated that future software defenders and attackers will likely use automated tools to locate and test flaws at speeds traditional manual audits cannot match.

What this means for Australian businesses

Many Australian small and medium businesses do not write operating system code, but almost all rely on Linux through web hosts, cloud databases, software-as-a-service providers, and office appliances.

• Apply system updates promptly. When AI tools can discover hundreds of flaws in days, the window between a vulnerability being known and someone exploiting it narrows quickly. Businesses should ensure automatic patching is active on servers, routers, and web hosting platforms.
• Review local access permissions. Local privilege escalation flaws matter once an intruder or malicious program already has a foothold. Staff accounts, web forms, and background services should run with the minimum permissions required for their tasks.
• Question vendors on automated security testing. When purchasing custom software or software services, ask software suppliers whether they test their own code repositories with automated code analysis tools before deploying updates to production.
• Audit open-source dependencies. Companies building their own web applications or customer portals should review third-party code libraries regularly and remove unused components to keep their attack surface small.