I used o3 to find a remote zeroday in the Linux SMB implementation (sean.heelan.io)

Article summary

The article discusses how the author used OpenAI's o3 model to find a remote zeroday vulnerability in the Linux kernel's SMB implementation. The vulnerability, CVE-2025-37899, is a use-after-free bug in the session logoff handler. The author found that o3 was able to comprehend the code and spot the vulnerability, and also discovered another vulnerability, CVE-2025-37778, in the kerberos authentication path. The article highlights the potential of LLMs in vulnerability research and the need for effective triage of results.

Main themes

• LLMs in vulnerability research
• signal-to-noise ratio
• vulnerability detection
• human augmentation
• software testing
• overfitting and bias
• exploit generation
• SMB implementation security
• kernel vulnerability research

What commenters say

• Some commenters believe that the signal-to-noise ratio of LLMs in vulnerability research is too low to be practical, while others argue that it can still be useful with proper triage.
• The effectiveness of LLMs in finding vulnerabilities depends on the quality of the input and the ability to generate meaningful tests.
• LLMs may not be able to replace human vulnerability researchers, but they can augment their work and increase efficiency.
• The use of LLMs in vulnerability research raises concerns about overfitting and the perpetuation of existing bugs.
• Some argue that designing and building testable software is a more complex task than writing the business logic itself, and that LLMs may not be able to fully replace human expertise.
• Others suggest that LLMs can be used to generate exploits and test them, and that this approach may be more effective than traditional methods.
• There is disagreement about the usefulness of LLMs in vulnerability research, with some seeing them as a valuable tool and others as a source of noise and false positives.