ChatGPT creator OpenAI says AI can mass produce ways to take over computers running on Linux software, which underpins global IT infrastructure including crypto and blockchain systems.
The company said its AI found 948 flaws at a cost of $1,279 per instance in the Linux Kernel, the core of the Linux operating system, and wrote a working attack for each one.
These let someone who already has limited access to a Linux machine, such as a basic user account on it, take full control of it. OpenAI said they worked on a standard Linux desktop with normal security protections turned on.
OpenAI said its system works in steps. It finds risky code and looks for flaws, then tests them in a safe sandbox. It then checks whether they can be used in an attack and, if so, drafts a fix.
Human researchers review the results before they go to the people who maintain Linux.
OpenAI said its goal is defense, meaning finding these flaws before hackers do, so they can be fixed. According to the firm, the 948 flaws its AI found are hypothetically worth $18.9 million to $66.3 million, against the $1.2 million it cost to run the AI, going by what typical cash prizes are paid at hacking contests such as Pwn2Own.
“This demonstrates the relative efficacy of using AI models for securing software—defenders should proactively analyze software to make cyber attacks cost-prohibitive,” OpenAI said.
In other words, finding these bugs costs less than what the flaws are hypothetically worth, so defenders need to find them before attackers do.
OpenAI didn’t mention crypto, but the industry has a stake in this as most of the blockchain infrastructure runs on Linux. Ethereum nodes, the computers that keep the network running, are one example, with about two-thirds of them using Linux, according to ethernodes.org.
As such, crypto experts say the industry is better placed than most to handle flaws like these.
“Crypto’s decentralization makes it inherently resistant to these kind of exploits,” Mudit Gupta, chief technology officer at Polygon Labs, told CoinDesk. “Decentralization brings diversity in infrastructure and redundancy which make crypto much more resilient to bugs like this than traditional software.”
Caducus, a blockchain evangelist and security researcher who posts as @chain_linkd on X said crypto’s exposure to attacks has already made it stronger.
“AI discovers vulnerabilities at a 10000x and soon decentralization and crypto will be the most resilient thing in existence. Getting attacked first, because there is a literal bounty on it, made it resilient, you don’t wanna imagine what happens to everything else...,” Caducus said.
The results are OpenAI’s own, and the model behind them hasn’t been released.