OpenAI multi-agent system discovers 948 high-severity vulnerabilities in the Linux kernel

The Linux kernel is one of the most important software infrastructures in the world, widely used in devices and systems such as Android smartphones, cloud computing platforms, data center servers, and supercomputers. Because the codebase is extremely large, finding potential security vulnerabilities has always been a time-consuming and complex task.

OpenAI said that this research did not simply ask an AI model to look for vulnerabilities, but instead built a complete multi-stage automated security research pipeline to conduct an industrial-scale audit of the Linux kernel. The entire system is completed through the collaboration of multiple dedicated AI agents, automating everything from target selection and vulnerability analysis to vulnerability verification, exploit testing, and patch generation.

In the first stage, an AI agent called "Scout" first analyzed the kernel codebase and filtered out functional modules and files that ordinary users can access. In the end, the system identified about 2.8 million lines of key code out of more than 40 million lines as audit targets, accounting for about 7% of the entire Linux kernel codebase, and selected a total of 5,034 potential targets for in-depth inspection.

Subsequently, the "Analyst" agent performed security analysis on this code and discovered 2,308 potential vulnerability candidates within 12 hours. After that, the "Triage" agent reproduced and verified these findings in isolated virtual machine environments, successfully confirming 1,724 real vulnerabilities in about 30 hours.

After completing verification, the AI system further assessed the exploitability of these vulnerabilities. It ultimately generated proof-of-concept programs for 291 information disclosure vulnerabilities, as well as 1,169 valid attack samples capable of achieving local privilege escalation. After deduplication analysis and classification, the research team confirmed that these corresponded to 948 independent vulnerabilities.

OpenAI said that these attack samples were all tested in standard desktop system environments with modern Linux security protection mechanisms enabled, including mainstream protection technologies such as KASLR, SMEP, and SMAP. This means that the relevant vulnerabilities still have exploitation value even in environments with common security protections in place.

More notably, the researchers said that during the analysis process, the AI system discovered and used at least 10 previously undisclosed Linux vulnerability exploitation techniques. These include new kernel object spraying methods, memory page grooming techniques, and various data attacks that can achieve privilege escalation without traditional code execution. For security reasons, OpenAI did not disclose the specific details of these techniques.

The data shows that the entire project consumed about $1.21 million in API computing resources, with an average cost of about $1,279 per usable privilege escalation vulnerability discovered. OpenAI pointed out that, calculated according to the standards of past vulnerability reward programs in the security industry, the total potential bounty value corresponding to these 948 vulnerabilities could reach between $18.9 million and $66.3 million.

During the research, OpenAI began submitting vulnerability reports and remediation plans to the Linux maintenance community. The company said that during a 10-day coordinated disclosure process, 61 privilege escalation vulnerabilities had been formally fixed, 43 vulnerabilities had entered the patch testing stage, and another 299 vulnerabilities were in the public discussion and review process.

This achievement also demonstrates the growing capabilities of artificial intelligence in the field of cybersecurity. In June this year, OpenAI announced that its GPT-5.5 Cyber model had discovered and verified 24 Linux privilege escalation vulnerabilities; in another test conducted in July, the company's model discovered 166 independent vulnerabilities. By comparison, the 948 vulnerabilities found in this latest experiment represent an increase of more than fivefold, even though the Linux kernel has undergone extensive security hardening over the past few months.

OpenAI believes that vulnerability discovery work will increasingly trend toward scale and automation in the future. Vulnerability hunting tasks that once took security researchers weeks or even months to complete are now gradually evolving into standardized processes continuously run by artificial intelligence systems. However, the company also emphasized that human researchers remain indispensable, because key steps such as vulnerability confirmation, impact assessment, and responsible disclosure still require professional personnel to participate in review.

As AI model capabilities continue to improve, the cybersecurity industry is entering a new stage. On the one hand, defenders can use artificial intelligence to discover and patch vulnerabilities at an unprecedented speed; on the other hand, this technology also means that attackers may gain more powerful automated attack tools in the future. How to strike a balance between improving defense efficiency and preventing abuse risks is becoming an important issue of concern across the entire cybersecurity field.