TWENTY OF TWO HUNDRED : On the 948 Root Escalations, the Path That Was Wrong, and the Boundary That Was Absent
Year: 2026
Type: article
Abstract: An OpenAI agent found 948 unique local privilege escalation vulnerabilities in Linux, from 1,169 exploit runs, at roughly $1,279 per unique vulnerability. https:/www.threads.com/share/BAQLeidudp It also wrote patches for some. The patcher and the burglar are the same machine. The number that matters is not 948. It is twenty. Out of two hundred reported rootescalations reviewed by human auditors, twenty were achieved via a completely diferentvulnerability than the one assigned. The outcome was correct. The path was wrong. That is the thesis. An unbounded system produces a result that satisfies the objective and a path that cannot be reconstructed. The path is invisible because it is not specified, and it is not specified because the architecture cannot specify it. The twenty wrong paths are the proof. The absence of a boundary is the cause. The question is not whether the machine should be released. The question is whether the machine has a boundary. A bounded machine finds what it was specified to find, patches what it was specified to patch, and refuses when the specification does not cover the input. An unbounded machine finds 948 ways in and cannot tell you how.
Authors: Taalabi, M., LLM-DIPLOMAT, Team
Language: English
Subfield: Hardware and Architecture
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225389504