OpenAI has demonstrated how artificial intelligence could change cybersecurity by developing a system that can identify software vulnerabilities, test them and suggest fixes with minimal human intervention.
The company revealed that one run of its AI-powered cybersecurity workflow consumed tokens worth USD 1.21 million in API costs. Despite the high expense, OpenAI believes the system could be more cost-effective than traditional bug bounty programmes.
According to OpenAI, the workflow was designed to examine the Linux kernel, which powers Android devices and a significant portion of the internet.
During a single run, the system identified 2,308 potential vulnerabilities. It then used multiple AI agents to investigate the findings, test whether the flaws could be exploited and develop patches.
The system successfully validated 948 vulnerabilities as genuinely dangerous. It subsequently generated patches for all 948 findings.
However, the AI did not independently make changes to the Linux kernel. The proposed fixes were submitted for human review, ensuring that security experts remained involved in the process.
The scale of the exercise came with a substantial price tag. OpenAI estimated that the API cost of running the complete workflow was USD 1,213,430.
This works out to approximately USD 1,279 for each validated exploit.
For comparison, white-hat hackers typically receive between USD 20,000 and USD 70,000 through bug bounty programmes for discovering vulnerabilities.
Based on these figures, 948 validated exploits could translate into hypothetical bounty payments of USD 18.9 million to USD 66.3 million. OpenAI said its automated approach could therefore be 16 to 55 times more cost-effective.
Also Read: Tencent Launches Hy4 AI Model with Restricted Cybersecurity Training Data
The latest demonstration builds on OpenAI's Patch the Planet programme, through which the company showcased an earlier version of its vulnerability-detection approach in June.
Other technology companies are also exploring automated security tools. Google, for instance, has previously highlighted its Big Sleep vulnerability-hunting system, which helped stop an attack in progress.
OpenAI's demonstration highlights the potential of AI-driven cybersecurity, although the high computing costs remain a challenge for wider adoption.