A security researcher says OpenAI’s o3 model helped uncover a remote zero-day vulnerability in the Linux kernel’s SMB implementation, identified as CVE-2025-37899. The account comes from Sean Heelan’s technical post, which describes how he used o3 while auditing ksmbd, the in-kernel SMB server used for file sharing over a network.
The post says the bug is a use-after-free in the handler for the SMB logoff command. It also says the issue emerged while Heelan was benchmarking o3 against vulnerabilities he had already found in ksmbd manually. In his description, the model was able to reason through concurrent connections and spot a path where an object could be freed while still reachable by another thread.
That is the central claim of the piece: not that an AI system independently audited a kernel tree end to end, but that o3 helped surface a specific weakness in a bounded codebase when given carefully prepared context. The article emphasizes that setup. Heelan says he passed the model the session setup handler and related code, along with the functions needed to understand how requests are parsed, dispatched and torn down.
Heelan frames the result as evidence that LLMs have become materially better at code reasoning. He argues that for repositories or subsystems small enough to fit into a constrained analysis window, o3 may now be able to solve problems or help solve them. He also compares the output quality of o3 with earlier Claude Sonnet models, saying o3 produced fewer false negatives on his benchmark and that its reports were more concise and more like a human-written bug note.
The write-up goes further than a simple demo. It contrasts a manually found vulnerability, CVE-2025-37778, with the second issue that o3 found, and it explains why the SMB command handlers in ksmbd were a useful test case. The article also says the benchmarking was repeated many times and that the result was not perfectly stable across runs, which matters for interpreting any AI-assisted security finding.
What the source does not do is establish a broad general rule for vulnerability research. It presents one researcher’s benchmark and one successful discovery. That is still significant, because it shows a real kernel bug identified in a public write-up through a workflow that involved an LLM and a carefully bounded code slice. But the article should be read as a technical case study, not as proof that AI has replaced human researchers.
The most defensible conclusion is narrower. According to the post, o3 helped a researcher find CVE-2025-37899 in the Linux kernel’s SMB code, and it did so in a setting designed to test reasoning rather than to impress. That makes the story notable both as a vulnerability disclosure and as a data point in the debate over how capable frontier models have become on hard code-analysis tasks.
