OpenAI Finds 948 Local Privilege Escalation Bugs in the Linux Kernel

Re:OpenAI Finds 948 Local Privilege Escalation Bugs in the L... by eqvinox on Friday November 06, 2026 @09:14AM (#50392523)

Speaking as someone responding to security@ for a notable FOSS project, a meta-comment:

Our current quota is, ca. 20% of AI-found "critical" issues are in fact critical. 3-5% of reported "high" are also critical (i.e. unfortunately it's not possible to rely on AI being excessively alarmist, it does under-classify some issues.)

Simultaneously, ca. 35% of reported "critical" are not even actual security issues. (May be biased due to the nature of our project, AI seems to have issues understanding security boundaries.)

Possible some of this is due to "they're prompting it wrong". Hard to tell since we don't have access ourselves.

I've not seen major differences between models & vendors, but we mostly get reports from Anthropic.

[ Parent | on HN ]

Re:OpenAI Finds 948 Local Privilege Escalation Bugs in the L... by pixl97 on Friday November 06, 2026 @09:51AM (#50393006)

>Our current quota is, ca. 20% of AI-found "critical" issues are in fact critical.

What percentage of ALL returned AI security bugs are critical?

[ Parent | on HN ]

Re:OpenAI Finds 948 Local Privilege Escalation Bugs in the L... by eqvinox on Friday November 06, 2026 @03:41PM (#50398203)

> What percentage of ALL returned AI security bugs are critical?

Currently ca. 2%. Not sure this is a useful measure though, all of the batches had a whole bunch of low severity stuff (correctly flagged as such) that technically is indeed a security issue but practically irrelevant.

[ Parent | on HN ]