OpenAI Finds 948 Local Privilege Escalation Bugs in the Linux Kernel

OpenAI’s reported pipeline generated 948 local privilege-escalation exploits at a substantial API cost. Some commenters called the result impressive if the vulnerabilities prove real, while others stressed that AI security reports can be misclassified: one project maintainer said many reports labeled critical were either less severe or not security issues, and argued that models often struggle to identify security boundaries. Another commenter doubted that the results came from autonomous discovery, suggesting knowledgeable researchers directing agents are what make the findings useful. The estimated cost per exploit also prompted concern that human review and validation could add costs comparable to, or several times greater than, the model run.

Kernel maintainers and users described the likely strain of processing and patching a growing stream of vulnerabilities. An IoT developer said new CVEs repeatedly disrupt security certification; commenters hoped AI might help with patching but worried that discovery could outpace remediation, or that poorly understood AI-generated fixes could create layers of fragile patches. The exchange about Rowhammer split over whether it is fundamentally unavoidable or a preventable hardware defect: one commenter viewed capacitor-based memory as inherently vulnerable, while another blamed cells packed too closely and argued manufacturers could mitigate the problem at added cost. The first countered that wider spacing would be expensive, slow, and no guarantee against attacks.