AI System Generates 948 Working Linux Exploits, Intensifying Fears Over Automated Hacking
An automated pipeline built on OpenAI’s agents produced 948 working Linux exploits, reproduced 1,724 vulnerabilities, and generated 291 information‑leak proof‑of‑concepts in 30 hours, at an API cost of about $1.2 million.
A recent experiment suggests that powerful AI systems can already automate much of the work involved in writing and refining exploit code.
Researchers built a pipeline using OpenAI agents and tasked it with generating exploit code for Linux vulnerabilities. In a 30‑hour run, the system created 948 working Linux exploits, reproduced 1,724 vulnerabilities, and produced 291 proof‑of‑concept exploits designed to leak information from target systems. The run reportedly cost about $1.2 million in API usage.
The AI agents were able to take descriptions of vulnerabilities, write exploit code, test it, and then iteratively fix errors until the exploit worked. That kind of loop closely mirrors what human penetration testers and attackers do, but at machine speed and scale.
For defenders, the headline numbers are troubling. Each working exploit is a ready‑made way to compromise systems that haven’t been patched. Automating exploit development at this pace could sharply reduce the time between a vulnerability being documented and large‑scale attempts to use it.
The same approach could in principle be turned toward other platforms beyond Linux, provided there is enough documentation and feedback for the agents to learn from. That prospect raises concern that well‑resourced attackers could pair AI‑driven exploit generation with automated scanning tools to find and hit vulnerable systems more quickly.
At the same time, the experiment points to potential defensive uses of similar pipelines, from large‑scale stress‑testing of software to faster patch development. Whether those defensive applications keep up with offensive possibilities will depend on how quickly organizations and regulators adapt.
Signals to watch include any moves by AI and cloud providers to limit automated exploit generation through policy or technical controls, and early signs that criminal or state actors are copying this model for use outside the lab.
Sources
- OSINT