AI Found 948 Linux Kernel Bugs — Here's How OpenAI's Models Did It

Tags: #security #openai #linux #ai

OpenAI's o3 and o4-mini reasoning models just changed what we thought AI could do in security research. Working alongside researchers, they surfaced 948 CVE-grade vulnerabilities in the Linux kernel — and autonomously exploited one of them end-to-end.

The key finding — CVE-2025-37899:

A use-after-free (UAF) bug in the Linux kernel's ksmbd SMB server module
Exploitable remotely and without authentication
The models generated working proof-of-concept exploits that bypassed both ASLR and KASLR — standard memory-randomization defenses on modern Linux systems
How the AI pipeline worked:

Models analyzed existing kernel patches to find similar bugs in adjacent code (variant analysis)
No human wrote the exploit — the models did it autonomously
OpenAI responsibly disclosed to Microsoft; the bug is now patched
Why it matters for developers:

The time between disclosure and working exploit is shrinking fast
AI lowers the skill floor for exploitation — defenders need to patch faster
Same capability cuts both ways: OpenAI also used AI to find 20+ CVEs in open-source projects defensively
OpenAI launched a $1M Cybersecurity Grant Program in API credits for defensive research.

📎 Media:

🎬 OpenAI for Government Forum: Advancing Cybersecurity — Official YouTube
🔗 NVD CVE-2025-37899 detail page
References & Credits:

AI News — OpenAI cyber model found 948 Linux kernel exploits
OpenAI — Official cybersecurity page
TechCrunch — OpenAI models help find 948 vulnerabilities (July 2, 2025)
The Verge — OpenAI 2025 Cybersecurity Report
HackRead — AI Can Now Write Actual Exploits
NVD — CVE-2025-37899
Video credit: OpenAI (official YouTube channel)