OpenAI said the company's AI identified 948 vulnerabilities in the Linux kernel and generated a working attack for every vulnerability. The company put the cost at $1,279 per instance. The Linux kernel forms the central component of the Linux operating system, which supports global information technology infrastructure, including blockchain and crypto systems.
The attacks allow a person with limited access, such as a basic user account, to gain complete control of a Linux computer. OpenAI said the attacks succeeded on a standard Linux desktop with the usual security protections enabled.
OpenAI said the system first examines potentially risky code for vulnerabilities and then tests the vulnerabilities in an isolated sandbox. The system next determines whether an attack can exploit each vulnerability and proposes a fix when exploitation is possible. Human researchers examine the findings before the findings reach Linux maintainers.
OpenAI said the purpose is defensive: discovering vulnerabilities before hackers find the vulnerabilities so repairs can be made. The company estimated a hypothetical value of $18.9 million to $66.3 million for the 948 flaws, based on typical prizes at hacking competitions such as Pwn2Own. OpenAI put the total cost of running the AI at $1.2 million. OpenAI argued that defenders should proactively examine software with AI to make cyberattacks prohibitively expensive. Discovering the flaws costs less than the hypothetical value of the flaws, making early discovery important for defenders.
OpenAI made no reference to crypto. Most blockchain infrastructure runs on Linux. According to ethernodes.org, about two-thirds of Ethereum nodes, the computers that sustain the network, use Linux. Crypto experts said the industry is better positioned than most industries to withstand vulnerabilities of this kind.
Mudit Gupta, chief technology officer at Polygon Labs, said decentralization gives crypto inherent resistance to such exploits. Gupta said varied infrastructure and redundancy make crypto substantially more resilient to these flaws than traditional software.
Caducus, a blockchain evangelist and security researcher, said, "AI discovers vulnerabilities at a 10000x". Caducus predicted that decentralization and crypto would soon become the most resilient systems in existence. Caducus argued that crypto became resilient because financial rewards for attackers caused crypto to face attacks early.
The findings come from OpenAI itself. The model used to produce the findings has not been released.