AI Found 948 Linux Kernel Bugs — Here's How OpenAI's Models Did It

Tags: #security #openai #linux #ai OpenAI's o3 and o4-mini reasoning models just changed what we thought AI could do in security research. Working alongside researchers, they surfaced 948 CVE-grade vulnerabilities in the Linux kernel — and autonomously exploited one of them end-to-end. The key finding — CVE-2025-37899: A use-after-free (UAF) bug in the Linux kernel's ksmbd SMB server module Exploitable remotely and without authentication The models generated working proof-of-concept exploits that bypassed both ASLR and KASLR — standard memory-randomization defenses on modern Linux systems How the AI pipeline worked: Models analyzed existing kernel patches to find similar bugs in adjacent code (variant analysis) No human wrote the exploit — the models did it autonomously OpenAI responsibly disclosed to Microsoft; the bug is now patched Why it matters for developers: The time between disclosure and working exploit is shrinking fast AI lowers the skill floor for exploitation — defenders need to patch faster Same capability cuts both ways: OpenAI also used AI to find 20+ CVEs in open-source projects defensively OpenAI launched a $1M Cybersecurity Grant Program in API credits for defensive research. 📎 Media: 🎬 OpenAI for Government Forum: Advancing Cybersecurity — Official YouTube 🔗 NVD CVE-2025-37899 detail page References & Credits: AI News — OpenAI cyber model found 948 Linux kernel exploits OpenAI — Official cybersecurity page TechCrunch — OpenAI models help find 948 vulnerabilities (July 2, 2025) The Verge — OpenAI 2025 Cybersecurity Report HackRead — AI Can Now Write Actual Exploits NVD — CVE-2025-37899 Video credit: OpenAI (official YouTube channel)