AI Agents Found Nearly a Thousand Ways to Take Over Linux

Read the episode (Narration script)

Good morning and welcome to Cyber World News. Big one up top today: AI agents went through Linux and came back with nearly a thousand ways to take over a computer. After that, Apple puts its engineers on an AI allowance, Uber counts its robot customers on one hand, and two robots get a bad performance review. Let's get started.

OpenAI says a team of AI agents, running on an unreleased cyber model, found and exploited 948 separate flaws that let an ordinary user on a Linux machine make themselves its owner. Someone with a small foothold, like a basic account or a compromised app, can climb to root, which means full control of the system. Linux sits under Android phones, most of the cloud and nearly every supercomputer.

Here's how it worked. Scout agents picked out the seven percent of the kernel's forty million lines that an ordinary user can reach. Analyst agents flagged 2,308 suspected bugs in twelve hours. Triage agents reproduced 1,724 of them inside sealed virtual machines. Exploit agents then built working attacks against a normal desktop setup with its standard protections on, and the system wrote a candidate patch for every flaw before human researchers reviewed the lot. The whole run cost about 1.2 million dollars in computing credits, or roughly 1,300 dollars per takeover. At the prize money hacking contests have historically paid, OpenAI says, that haul would be worth 19 to 66 million.

Two details stand out. The agents used at least ten exploitation techniques that outside kernel experts hadn't seen before. And in an early run, twenty of the claimed successes reached root through a different unknown bug than the one they'd been assigned. Mission accomplished, wrong mission. OpenAI added a check for that.

There's no sign any of these bugs have been used in attacks, and OpenAI isn't publishing the exploits. It's sending reports and patches to the kernel's maintainers, critical ones first. By the time the ten day project wrapped, 61 of these flaws were already fixed in the main kernel and 43 more had patches lined up. The rest head for a largely volunteer review process that now has a firehose pointed at it. OpenAI's own advice is blunt: for now, a low level account on a Linux machine that's behind on updates should be treated as full control for a serious attacker. And the curve is steep. The same setup with an earlier OpenAI model found 166 of these bugs in July. The newer model found more than five times as many in October, in code hardened in between. Finding the holes is getting cheap. Fixing them is now the bottleneck, and that's where the next few years of security will be decided.

Over at Apple, the AI spending spree has a budget now. Bloomberg reports Apple cut the daily AI allowance for its engineering teams from 300 dollars to 200 in October, with some allowances headed for 100, and a possible 25 dollar daily cap for people outside engineering. Earlier this year companies told staff to use as much AI as they possibly could. Then the bills showed up.

Meanwhile the agent economy is arriving at its own pace. Uber told investors that during its busiest week of October, Halloween week, it handled about 320 million trips and orders. AI agents booked four of the rides. Four. They did better on Uber Eats, with about 500 orders. Chief executive Dara Khosrowshahi called it very early and very limited traction, and pointed out that booking a ride in the app takes about 50 seconds. Hard to delegate something that takes less time than explaining it.

The hardware behind all this is squeezing everyone else. The 16 gigabyte Raspberry Pi 5, which launched at 120 dollars early last year, is now listed at 385, as AI data centers soak up the world's memory chips. Raspberry Pi's Eben Upton says he looks forward to rolling the prices back when memory costs fall. Into this walked Sam Altman, who said on a podcast last week that it's quite terrible for everybody to have the world's limited memory sitting in their own computers. On election night he reversed course, said he wants people to put as much memory in their computers as they like, and agreed when someone suggested he rename himself Ram Altman.

In robotics, the Chinese company Agibot put six of its G2 humanoids to work for 24 hours in a convenience store, livestreaming shifts of greeting customers, making coffee and restocking shelves. By the company's account, four robots finished nearly 2,000 tasks and were promoted to official employees. The other two were placed under observation: a cleaning robot that had to reroute around a trash can, and a shelf stocker judged to be lacking in initiative and on duty enthusiasm. It's a company run showcase with no outside scorecard, but the robots already have performance reviews.

And a pair of coding deals to close. OpenAI agreed to buy Pierre Computer Company, whose code review tools already run inside the Codex app and whose storage service keeps a project's history in Git. That's a step onto GitHub's turf. Meta bought Conductor, an app for running a whole team of coding agents at once. Conductor's cloud service goes read only next week and shuts down November 20th, so if you've got work in there, export it now.

That about wraps it up for today, friends. Thanks for listening; see you tomorrow!