Welcome to the PMBug forums - a community supported watering hole for folks interested in gold, silver, precious metals, sound money, investing, market and economic news, central bank monetary policies, politics and more.
Register a free account to join the discussions. When you register an account and log in, you may enjoy additional benefits including access to market data/charts and additional members only rooms (including one for trade/barter with the community).
They are, but it's not every single computer the gov owns.
OpenAI just published research showing models found and developed exploits for 948 local privilege escalation (LPE) vulnerabilities in the Linux kernel, spending $1.2M in API credits.
To put this into perspective: the Linux kernel powers almost all cloud infrastructure, Android devices, supercomputers, and modern networking. Linux enforces process isolation. An unprivileged application, like a calculator or a basic utility, is not supposed to read memory, inspect processes, or touch cryptographic keys held by another process or software wallet.
A local privilege escalation simply breaks that security boundary. It allows an unprivileged process to escape its world and gain root control over the entire system (like full access to everything).
OpenAI demonstrated that an automated pipeline can discover nearly a thousand ways to do this in a single campaign. While the research is impressive, it exposes three uncomfortable realities:
Finding bugs is not fixing bugs
LLMs are remarkably good at static analysis, reproduction, and exploit generation. Generating sound patches for complex kernel code is an entirely different challenge. Kernel fixes often introduce performance regressions, subtle race conditions, or fail to address the root architectural variant.
The attack surface remains massive
These 948 exploits targeted only local privilege escalation, and only audited a fraction of the kernel code. They do not account for remote code execution, network stack vulnerabilities, firmware flaws, or supply chain compromises. Finding 1,000 paths to root does not mean the system is secure; it simply means we mapped 1,000 holes in a 40-million-line dam. The density of vulnerabilities in software is extremely higher than anyone thought before
The defensive economics do not scale
A $1.2M audit run is pocket change for a frontier AI lab or a patient nation-state adversary. But virtually no open-source maintainer, startup, or enterprise can spend millions of dollars per release cycle on tokens just to partially reduce latent vulnerabilities. If defense costs millions of dollars per scan while sophisticated attackers only need to find one unpatched path, the asymmetry favors the attacker.
The real lesson here is that software isolation alone will always fail under automated adversarial pressure. The only durable answer is architectural: minimizing attack surfaces, proving security invariant, enforcing strict hardware roots of trust where secrets live, and building toward cryptographic guarantees that make critical compromises structurally impossible rather than merely expensive.
A computer not connected to the internet is just fine, regardless of the OS.
