{
  "id": 18906077,
  "title": "AI Found 948 Linux Kernel Bugs — Here's How OpenAI's Models Did It",
  "url": "https://urgent.news/2026/11/08/ai-found-948-linux-kernel-bugs-heres-how-openais-models-did-it",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-08T09:34:39.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ajambla/ai-found-948-linux-kernel-bugs-heres-how-openais-models-did-it-422k"
  },
  "original_language": "en",
  "account": "OpenAI's reasoning models o3 and o4-mini have made headlines by discovering 948 security vulnerabilities in the Linux kernel, each with the potential to be classified as a Common Vulnerabilities and Exposures (CVE). The breakthrough occurred in collaboration with researchers, with the models autonomously identifying and exploiting a particular vulnerability, CVE-2025-37899. This exploit is associated with a use-after-free (UAF) bug in the kernel's ksmbd SMB server module. The flaw is remotely exploitable and does not require authentication, posing a significant threat to Linux systems. The models generated functional proof-of-concept exploits that bypassed both Address Space Layout Randomization (ASLR) and Kernel Address Space Layout Randomization (KASLR), which are common memory-randomization defenses used in modern Linux systems. The entire process involved the models analyzing existing kernel patches to uncover similar bugs in adjacent code, a technique known as variant analysis. Importantly, the exploit was not crafted by human intervention; the AI models accomplished this autonomously. OpenAI has responsibly disclosed the vulnerability to Microsoft, which has since patched the flaw. This incident highlights the rapid evolution of AI capabilities in the realm of security research, as the time between vulnerability disclosure and the creation of a working exploit has significantly decreased. While AI significantly lowers the skill threshold for exploiting vulnerabilities, it also enables defenders to identify and remediate issues more swiftly. OpenAI has taken this a step further by launching a $1 million Cybersecurity Grant Program, offering API credits to researchers for conducting defensive research.",
  "summary": "Tags: #security #openai #linux #ai OpenAI's o3 and o4-mini reasoning models just changed what we thought AI could do in security research. Working alongside researchers, they surfaced 948 CVE-grade vulnerabilities in the Linux kernel — and autonomously exploited one of them end-to-end. The key finding — CVE-2025-37899: A use-after-free (UAF) bug in the Linux kernel's ksmbd SMB server module…",
  "key_points": [
    "OpenAI's models o3 and o4-mini discovered 948 Linux kernel bugs.",
    "Identified CVE-2025-37899, a use-after-free bug in ksmbd SMB server module.",
    "Models autonomously created functional exploits bypassing ASLR and KASLR defenses."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}