OpenAI's New Cyber Model Found Ways to Attack Nearly 1,000 Linux Flaws (axios.com) 33
OpenAI says its new GPT-6 Cyber model helped an automated system identify 1,724 security flaws in the Linux kernel and exploit 948 of them to gain administrator-level access during testing, including at least 10 previously unknown techniques. Axios reports: During testing, the system identified 1,724 security flaws and found ways to use 948 of them to gain administrator-level access to Linux systems for about $1.2 million in API credits. At least 10 of the techniques the model used were previously unknown, according to OpenAI. Human researchers reviewed the Linux findings before reporting vulnerabilities and proposed fixes to maintainers. The model also uncovered 81 previously unknown, high-severity flaws in Mozilla's Firefox browser.
Yeah, sure. (Score:1, Flamebait)
Source: #TrustMeBro.
Re: (Score:2)
Source is the people behind the model, and considering the total shit show that was Black October, they are almost certainly not fucking around.
Low-hanging fruit - "for AI" (Score:5, Insightful)
This is no surprise. When a new bug-hunting technique comes along, it's bound to find lots of things that weren't easy to find with existing techniques but are easy to find with the new technique.
In a few months the "very easy to find" bugs will be found, and a few months later the "easy to find" ones will be identified, and the thousands-of-new-bugs-every-month that you are seeing in the kernel and from Microsoft will get back down to more reasonable levels.
Re: (Score:3, Informative)
The problem is that this sort of AI assisted penetration testing is still fairly new, and has only had meaningful teeth since last month.
And we had what infosec people already dubbed Black October from it. PHP vulnerabilities alone were a shitshow of truly epic proportions, with government, banking and even IT megacorps being impacted.
The problem seems to be the unique combination of speed and volume of vulnerabilities being discovered all at once, making it prohibitively difficult to patch, validate and di
Arsenal of black hats getting smaller hopefully (Score:2, Insightful)
The problem is that this sort of AI assisted penetration testing is still fairly new, and has only had meaningful teeth since last month.
Still, automation only makes the situation better. Hopefully some exploits black hats and nation states were holding back for future mischief is being found now, their arsenal getting smaller.
The problem seems to be the unique combination of speed and volume of vulnerabilities being discovered all at once, making it prohibitively difficult to patch, validate and distribute patches in time.
True, but new automated tools supplementing the normal pre-release human testing should make these situations outliers.
Re: (Score:2)
Thankfully, there are a finite number of old bugs. Unless new bugs are introduced at least as fast as old ones are found and fixed, the bug-pocalypse should ebb.
Re: (Score:2)
There is also rather strong indication that LLMs have peaked a while ago.
Re: (Score:2)
Exactly. The thing is LLMs do not find more bugs than (smart) humans. They find less. But they find different ones to a degree and if applied to code that nobody has reviewed or checked with tools for a long time, they find relatively easy to spot ones.
The actually interesting question is what bugs do LLMs do not find. From patch notes on tools where LLM gets credited, the majority of security critical bugs are outside of LLM reach. For example, for that widely published "LLM finds 271 zero-days in FF!", it
Wait (Score:2, Interesting)
Re:Wait (Score:5, Interesting)
It's a question of priorities. If the exploit requires you to be in the network, install a special usb device on the server, interrupt the boot process, flood a specific port with malformed packets, do it on February 29th at 11:59.59 pm, and call your mother first, it's gonna bubble down on the priority list.
Re: Wait (Score:2)
Re: Wait (Score:5, Insightful)
I think you're focusing too much on the number 900. How are these things counted? How *should* they be counted? Are they 900 variations on a single idea? Are they 450 variations on two distinct ideas? There's plenty of redundant software patterns and anti-patterns in a code base as large as the Linux kernel, so double counting is expected to be rampant.
Similarly, with Linux distros: Attack viability will depend on the mix of installed software packages. Some things are more important than others, and should be counted differently.
AI companies like to claim "number go up" so as time goes by they will make "bigger number" announcements. Ignore the number. It's the distinct ideas that matter.
it's a relative competition (Score:2)
Well, Linux so far only had to be more secure than MS Windows.
Re: (Score:3)
It's a question of priorities. If the exploit requires you to be in the network, install a special usb device on the server, interrupt the boot process, flood a specific port with malformed packets, do it on February 29th at 11:59.59 pm, and call your mother first, it's gonna bubble down on the priority list.
That is why it requires so many tokens.
Re: (Score:2)
Re:Wait (Score:5, Interesting)
Well, considering the number of updates that have been hitting me recently, I'd say that they've likely been already patched. But I sure wish I felt more certain.
Re: (Score:2)
Another possibility. They're testing it against an old Linux kernel with a large backlog of vulnerabilities that have since been addressed. This is at least as good as testing the current kernel - in fact, it's better, since the results can easily be compared to the issue trackers to see how many it caught correctly.
Re: (Score:2)
While this is a sound approach to test your tools, if you then use the large number in a press release, it becomes a lie.
Re:Wait (Score:4, Insightful)
948 paths to admin, and only 10 of them were unknown? What are you doing, Linux?
How I read this is that 10 new techniques were found. Meaning that (made up numbers here) 300 of those security flaws could be Buffer overflows in various components, 150 side channel attacks, 100 race conditions, 80 DoS vectors, etc. etc.
And on top of these, 10 completely new ways to attack code were found.
Re: (Score:2)
More like what the hell are the LLM-pushers claiming here ...
From Greg Kroah-Hartman (Score:4, Interesting)
People should watch his talk in this year's Kernel Recipes where he provides more insight about these LLMs' capabilities.
https://www.youtube.com/watch?... [youtube.com]
The problem is people need to triage these reports and that is very time consuming.
Re:many eyes (Score:4, Insightful)
Good (Score:5, Interesting)
I, for one, am very glad that someone is spending all this money to find these vulnerabilities, and reporting them back.
Linux always has been doing its code in the open, and while all of a sudden there is a lot more vulnerabilities reported, it is actually a very, very low number when compared to the size and complexity of the code base.
Now, if you want to see some horror stories, have a look at code that was developed away from public scrutiny.
Re: (Score:2)
I, for one, am very glad that someone is spending all this money to find these vulnerabilities, and reporting them back.
This. What do you want to bet the NSA and various other spy/nefarious agencies already know about several of these?
N1 (Score:2)
What constitutes 1 bug? Or are they "bundles" of 100s of bugs that would normally be considered 1 exploit? Click bait over inflated numbers.
And Microslop? (Score:2)
"at least 10" (Score:2)
Re: (Score:2)
Indeed. Also note that for each kernel release (and they do not even say kernel as far as I can see, they say "Linux", which can be a full distro repo with 1000s of packages) humans find more, which nicely shows the inferiority of LLMs. Most are hard to exploit and need specific circumstances.
OpenAI attacking OpenAI (Score:1)
Re: (Score:2)
Because they could not fake that?