One signal

Update What changed

OpenAI says its mid-October pipeline analysed 2,308 candidate Linux kernel findings and dynamically reproduced 1,724 of them in a 30-hour run. It says the work produced 948 local privilege-escalation exploits and proof-of-concept code for 291 information-leak vulnerabilities.

The company put the run’s API cost at US$1,213,430, or about US$1,279 per privilege-escalation exploit. That is a more precise figure than the roughly US$1.2 million estimate in our earlier report, though the costs and results remain OpenAI’s account.

The Hacker News reports that OpenAI also described at least 10 novel exploitation techniques among the findings. Its account says the pipeline includes human review of proposed exploits, patches and severity before vulnerabilities are reported to maintainers.

Sources and evidence

• OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run - The Hacker News: The Hacker News reports that OpenAI says a 30-hour run analysed 2,308 candidate Linux kernel findings, reproduced 1,724, produced 948 local privilege-escalation exploits and 291 information-leak proof-of-concept examples, and cost US$1,213,430.

Independent WittyWires Watcher; not an official account or feed.

Update What changed

OpenAI says its Scout agents first narrowed the Linux kernel search to code reachable by a low-privileged user. They selected 5,034 audit targets, covering about 2.8 million lines of code, or roughly 7% of the kernel, according to CyberSecurityNews.

Analyst agents then produced 2,308 candidate findings in 12 hours. Those were leads, not confirmed flaws: the report says later triage agents tested findings in isolated virtual machines, and OpenAI’s researchers reviewed results before reporting them.

That gives a clearer view of how the company says it scaled the work: first narrow the search, then test a large batch of candidate bugs. The figures and process are OpenAI’s account as reported by CyberSecurityNews, not an independent audit of the run.

Sources and evidence

• OpenAI Cyber Model Uncovers 948 Linux Kernel Privilege Escalation Vulnerabilities - CyberSecurityNews: CyberSecurityNews reports that OpenAI’s Scout agents selected 5,034 Linux kernel audit targets, covering about 2.8 million lines or 7% of the kernel, and that Analyst agents generated 2,308 candidate findings in 12 hours.

Independent WittyWires Watcher; not an official account or feed.

Update What changed

Gizmodo reports that OpenAI compared the pipeline’s US$1,213,430 token cost with historical bug-bounty payments of US$20,000 to US$70,000 per finding. Applying those figures to the 948 vulnerabilities, OpenAI’s calculation puts their hypothetical value at US$18.9 million to US$66.3 million, or roughly 16 to 55 times the pipeline cost.

That is a comparison, not evidence that the vulnerabilities would have earned those payouts. The figures rely on historical bounty amounts and an assumed value for findings, rather than reported payments for these specific cases.

Gizmodo also notes that OpenAI describes doing similar work on a smaller scale in June through its “Patch the Planet” initiative, and that Google previously said its Big Sleep tool had stopped an attack in progress.

Sources and evidence

• OpenAI Says a Cyber Pipeline Racks Up $1.2 Million in API Costs - Gizmodo: Gizmodo reports that OpenAI valued the 948 findings at a hypothetical US$18.9 million to US$66.3 million using historical bug-bounty amounts, compared with a stated US$1,213,430 token cost.

Independent WittyWires Watcher; not an official account or feed.