Unconfirmed: a post on X is circulating with a claim that Trail of Bits used OpenAI Codex to help land fixes for 149 Linux security vulnerabilities, and Automatica has not confirmed that claim.
@twtayaan wrote on 4 November that:
Linux got 149 security vulnerabilities patched with help from OpenAI Codex. The fixes already existed in newer code. Older Linux versions were still missing them. Trail of Bits used Codex to find those gaps, adapt patches and run tests. By October 29, the work had helped get fixes for 149 distinct CVEs into stable Linux kernels. Work that could take days now needs roughly 30 minutes to three hours of human preparation and review per fix. Engineers still review the patches and submit them to maintainers. Regression testing and acceptance remain essential. The project has also delivered fixes for Fedora and Ubuntu packages. [@twtayaan on X](https://x.com/twtayaan/status/2117853549820608909)
That post meets the minimum engagement threshold in the available evidence, with 22 likes and 12,975 followers as observed there, but social engagement is not verification @twtayaan on X1. The supplied material does not include a Trail of Bits announcement, a Linux kernel mailing-list thread, a security advisory, or an OpenAI statement confirming the work. On the evidence provided here, what can be verified is that the post exists and makes those claims.
What would confirm the rumour is straightforward: a primary statement from Trail of Bits or OpenAI, or patch-level evidence tying specific stable-kernel fixes to a Codex-assisted workflow. A contrary company statement, or an inability to match the claimed 149 CVEs to published fixes and maintainers' submissions, would cut against it. In the supplied evidence, Trail of Bits, OpenAI, Linux maintainers, Fedora and Ubuntu have said nothing.
There is at least some limited background for why readers are paying attention to the OpenAI part of the claim. In earlier reporting, Automatica Press noted that OpenAI had described Codex-related internal use cases, including planning, browser tasks and refactoring, and described an internal tool called Ultrafast for incident-response work Automatica Press2. That is not independent confirmation of the Linux-patching claim, and it does not establish Trail of Bits usage, kernel acceptance, or the reported CVE count.
The numbers in the post also need careful handling. The claim cites 149 distinct CVEs, fixes present in newer code but missing from older branches, and a reduction to roughly 30 minutes to three hours of human preparation and review per fix @twtayaan on X1. Without the underlying methodology, baselines, model version, test conditions, or a list of affected kernels and packages, those figures do not show how much work Codex performed versus engineers, how success was measured, or whether the process generalizes beyond the cited examples.
As an unconfirmed report, this remains a claim about a claimed workflow. The available evidence verifies attribution to one public post and provides only broad prior context that OpenAI has discussed Codex-related internal uses @twtayaan on X1 Automatica Press2.