OpenAI's AI built 948 ways to take over a Linux machine, so that overdue update just lost its 'when I get to it' status
By Brett Gavaghan, Founder of Adaptd ·
An unreleased OpenAI security model produced 948 distinct Linux exploits for about US$1,279 each. OpenAI's warning: an ordinary login on an unpatched system is now close to full control.
The short version
- An upcoming OpenAI security model built 948 distinct Linux kernel exploits in a 10-day run costing US$1.21 million.
- OpenAI warns a low-privileged account on an unpatched system should be treated like full admin access for a well-resourced attacker.
- Turn on automatic updates, ask your IT provider or web host about patching, and remove old logins.
Most of us treat the update prompt the way we treat the dentist's reminder text. OpenAI has just put a price on why that habit is getting riskier.
What did OpenAI find?
OpenAI ran an unreleased security model in an automated pipeline that built 948 distinct Linux kernel exploits, each one letting an ordinary user take full control of a machine. The October run took 10 days, cost US$1.21 million and scanned about 7% of the kernel, iTnews reports. Human researchers reviewed the results, and the pipeline also produced a patch for each flaw.
OpenAI's conclusion is the part to remember. It says an ordinary account on a system missing its latest patches should be considered "functionally equivalent to root access" for a well-resourced attacker. Root means full control.
Why does the cost matter?
The cost matters because finding these flaws is getting cheaper fast. OpenAI's October run worked out at US$1,279 per flaw at most, compared with about US$3,094 in a July run that found 166.
Bug bounties for this kind of exploit have historically paid US$20,000 to US$70,000 each. When the price of breaking in drops like that, more people can afford to shop.
What should your business do about it?
Your business should treat updates as a job with an owner and stop leaving them to whoever feels guilty first. Turn on automatic updates for laptops and phones, and ask your IT provider or web host when your servers were last patched.
My advice: assume a staff login can be stolen, so an old or forgotten account matters more than it used to. Remove accounts for people who've left, and turn on multifactor sign-in. If you're thinking "we don't run Linux", your website host, office storage box or some other bit of kit may well run it for you, so ask. The warning is aimed at well-resourced attackers, but today's expensive attack tends to become next year's cheap one.
Nobody ever got hacked because they clicked 'Update now'. Annoyed, sure.
Wondering what this means for your business?
That's exactly what the discovery call is for.