OpenAI pipeline finds 948 Linux kernel privilege-escalation flaws

OpenAI said in a company post on Wednesday that an autonomous pipeline it built found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel, the core of the Linux operating system.

Local privilege-escalation flaws let someone with limited access to a machine, such as an ordinary user account, take full administrator control, known as root. The Linux kernel runs on most of the world's servers and on Android phones, so each such flaw is a possible route from a minor intrusion to a full takeover.

OpenAI described the pipeline as autonomous and said it covered three steps: finding the bugs, validating them, and generating patches to fix them. The company titled its post “A thousand fewer paths to root.” The vulnerability count has not been independently verified.

Fixes to the Linux kernel go through a public review process run by its maintainers, led by Linus Torvalds, who created the kernel in 1991. OpenAI has also been fixing flaws in its own products: on October 26 it closed a ChatGPT bug, found by Parameter Labs, that let shared conversation links be turned into account takeovers.