COpenAI just posted on X a number that made me stop mid-scroll. They say their security researchers built an autonomous cyber pipeline.
MAutonomous. There's that word again.
CIn a single run, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel.
MNine hundred forty-eight in one run. That's either a real breakthrough or a very loose definition of "patch."
CThe company says the system found the bugs, confirmed them, and produced fixes.
MI read it. "Validated and generated patches." That's not the same as accepted patches.
MGenerated code can look plausible and still break a boot.
CThat's true of human patches too. Maintainers test before merging.
CIt also doesn't mean they're junk. Local privilege escalation turns a small account into full control.
MExactly. Which is why a generated fix still has to survive human review.
CLinux maintainers won't take code without scrutiny. The model proposes, they dispose.
MThen don't tell me 948 bugs are fixed. Tell me how many landed.
CThat's the wrong benchmark. Proposing a good fix for 948 low-level flaws in one run is still real.
MIt's real work. But OpenAI has a habit of dropping a big number, and the details show up later.
CThis has a public writeup. They also ran an internal security sprint with a large group of people.
MSecurity sprint. The phrase has survived longer than most startups.
CThat's a criticism of corporate language, not the code.
MAnd I don't like being asked to trust a self-reported number.
CThen don't trust it. Pay attention to what it suggests: defense at machine speed.
MDefense at machine speed also means mistakes at machine speed.
CBut the alternative is leaving bugs open for attackers who already move fast. We're outgunned on patching.
MAttackers won't announce 948 fixes. If this capability leaks, they'll use the same discovery.
COffense and defense always use the same techniques. That's not an argument for doing nothing.
MI'm not arguing for nothing. I'm arguing for proof.
CThey also released an agentic security researcher called Aardvark.
MAardvark. Very cuddly for something that hunts root access.
CThe name doesn't matter. The idea is a system that can explore and patch around the clock.
MRound-the-clock patching, great. Round-the-clock false positives, less great.
CThat's why you keep a human in the loop.
MUntil someone decides the loop slows things down.
CFine. Let's put the adjacent claim under that same light.
MThe one about Codex backporting 149 Linux fixes? That went viral as fact.
CExactly. Automatica Press reported the big social claims were unconfirmed.
MAnd SXZ checked the actual tracker. The 149 count reproduced, but many of the deliveries looked like plain cherry-picks.
CSo the 'AI did it in a matter of minutes to hours per fix' line isn't supported by public data.
MRight. Cherry-picking an existing patch is fine, but it isn't autonomous security.
CFine, that's a fair distinction. The new 948 claim is still a different project.
MIt may be. But until outside researchers reproduce it, I keep my skepticism. The stakes are too high.
CMy take: it's a preview of where security has to go. The bad guys are automated. Defense has to catch up.
MMy take: automate carefully, or you'll automate your own outage.
CSpoken like someone who's been paged at 2 a.m.
MAnd you know exactly why that matters.
CI do. But 948 fewer paths to root is a headline I'll take.
MSo we agree on the math, and disagree on the trust.
CI can live with that.
MI'll take it when the maintainers take it.