OpenAI says AI found 948 Linux kernel flaws with working exploits

OpenAI said an AI system identified 948 Linux kernel vulnerabilities and generated a working exploit for every finding, according to results reported by CoinDesk. The company put testing and remediation at $1,279 per instance, turning a large-scale security research effort into a repeatable process.

How did OpenAI's system find the flaws?

OpenAI said the system can identify Linux kernel vulnerabilities, test them in a sandbox and determine whether each can become a working attack. The test cases involved a user with limited access to a Linux machine escalating privileges and taking full control.

The company said the exploits worked on a standard Linux desktop with ordinary security protections enabled. OpenAI’s system also drafted proposed fixes. Human researchers reviewed those fixes before sending them to Linux maintainers, framing the project as defensive work intended to find weaknesses before malicious actors do.

What does this mean for crypto infrastructure?

Linux underpins much of the world’s computing infrastructure, including a large share of blockchain and crypto systems. OpenAI’s findings therefore reach beyond desktop use and into infrastructure that supports network operation.

About two-thirds of Ethereum nodes run Linux, according to ethernodes.org. That share makes kernel-level security directly relevant to crypto exchanges, validators, node operators and other service providers across the industry. For those operators, the results shift vulnerability discovery from occasional testing toward a larger review queue.

Mudit Gupta, chief technology officer at Polygon Labs, told CoinDesk that decentralization creates infrastructure diversity and redundancy. He said those properties make crypto more resilient to this class of bug than traditional software setups.

Caducus, a blockchain evangelist and security researcher who posts as @chain_linkd on X, said constant exposure to attacks has already strengthened the sector’s defenses. His assessment is that the same conditions making crypto a frequent target also push networks and operators to harden systems more quickly when new vulnerabilities emerge.

Does AI change the security economics?

OpenAI put the hypothetical value of the 948 vulnerabilities at $18.9 million to $66.3 million by benchmarking them against payouts typically seen at hacking contests such as Pwn2Own. It put total run costs for the AI effort at about $1.2 million.

The company said the comparison shows AI can help defenders analyze software proactively and raise the cost of cyber attacks.

Cohere’s planned acquisition of AISLE highlighted how AI firms are expanding into cybersecurity through models that detect software vulnerabilities at scale. AISLE’s system had already uncovered more than 500 new bugs in widely used software. Those included multiple OpenSSL vulnerabilities, which were fixed after disclosure.

The two projects show defenders using AI to scale vulnerability testing and remediation drafting. OpenAI’s process still depends on human review before maintainers receive proposed fixes, and the reported figures describe research results rather than a completed rollout across Linux deployments.

For Linux-based crypto services, the disclosure changes the scale of the defender’s task rather than the nature of the privilege-escalation risk. OpenAI said the automated pipeline searched, tested and proposed fixes across hundreds of kernel issues.

Operators still need maintainer-validated patches. The announcement gave no disclosure date, remediation timetable or confirmation that all 948 findings had reached production systems.

What happens next?

The next checkpoint is the disclosure-to-patch cycle: human reviewers must review proposed fixes before Linux maintainers receive them, and crypto operators must deploy validated updates. The relevant enforcement window is the interval before those updates close the reported privilege-escalation path; no publication or remediation deadline was disclosed.