AI Finds 15-Year-Old Linux Bug No Human Could Catch

A security flaw that could have let hackers take complete control of Linux systems sat undetected in the code for 15 years until an AI caught what thousands of human experts had missed.

Nebula Security's AI tool called VEGA discovered GhostLock, a bug that shipped by default in essentially every major Linux distribution since 2011. Any logged-in user could exploit it to gain root access, the highest level of control over a computer system.

The bug was so reliable that Nebula's exploit worked 97 percent of the time in testing. It could even escape containers, the digital boxes that are supposed to keep different programs safely separated from each other.

Here's the remarkable part: human programmers had reviewed this exact code countless times over nearly two decades. Security researchers had audited it. Millions of developers had worked with systems containing this flaw. Yet it took an AI specifically designed to hunt for vulnerabilities to finally spot the problem.

Nebula earned $92,337 through Google's kernelCTF bug bounty program for the discovery. The company fixed the flaw in April 2025, though some popular Linux versions were still working on complete patches as recently as early July.

The Bright Side

This discovery isn't scary. It's actually a huge win for everyone who uses technology.

First, the bug got found and fixed before malicious hackers could weaponize it. That's millions of servers, computers, and devices now safer than they were before.

Second, VEGA is part of a new wave of AI tools that are systematically combing through old code that humans haven't carefully reviewed in years. These tools are finding and fixing problems faster than ever, making the software we all depend on more secure.

The real story here isn't about AI replacing human programmers. It's about AI becoming an incredibly powerful assistant that sees patterns and problems humans naturally miss. Human experts still write the code, design the systems, and decide what to do with AI findings. The machines just help us do our jobs better.

Think of it like having a tireless proofreader with a photographic memory working alongside every security team on Earth. VEGA doesn't get tired, doesn't skip sections, and can analyze millions of lines of code looking for the tiniest inconsistencies.

Google and other tech companies are now investing heavily in these AI security tools, creating bug bounty programs that reward both human and AI discoveries. The result is a safer digital world for everyone, from hospitals to schools to the phone in your pocket.

GhostLock's discovery proves that the future of cybersecurity isn't humans versus machines but humans and machines working together to keep us all safe.