Safety Filters Frustrate Researcher Investigating Possible Linux Kernel Bug

Security researcher Daniel Fox Franke says automated safety controls on a closed AI service repeatedly prevented him from using the system to investigate crashes involving the open-source utility ripgrep. He ultimately turned to open-weight models to continue the analysis.

Franke told The Register that the work began after ripgrep repeatedly crashed during a lengthy Codex session. He asked an agent to examine the failure, including how ripgrep and the musl C library handled memory allocation. OpenAI’s cybersecurity classifier flagged several of the resulting requests, particularly those involving crash reproduction and heap analysis.

According to Franke, he narrowed the task and explicitly instructed the system to focus on source-code analysis rather than reproducing the crash or inspecting core files. The classifier nevertheless continued to block responses. Franke said the underlying GPT-5.6 Sol model appeared willing to assist, but the separate filtering system interrupted the exchange.

He also said he did not try Anthropic’s models because he expected their restrictions to be more pronounced. OpenAI’s error messages referred him to its Trusted Access programs for security researchers, but he did not pursue verification. He described the process as burdensome and said open models remained a workable alternative.

Open models provided different levels of assistance

Franke used Moonshot AI’s Kimi K3 and Z.ai’s GLM-5.2 during the investigation. He credited K3 with identifying evidence that the problem might involve the Linux kernel, while describing some of its later reasoning as unreliable and prone to unsupported conclusions. GLM-5.2 subsequently reviewed that work and helped assemble what Franke considered a stronger technical case.

The researcher emphasized that the investigation is incomplete. He believes the crashes are caused by a kernel defect and has identified a possible kernel bug, but has not established that the suspected defect is responsible for the ripgrep failures. He said there is currently no patch and that the issue does not appear to be exploitable.

The episode highlights a continuing tension in AI security tooling: safeguards intended to limit assistance to attackers can also interfere with legitimate debugging and vulnerability research. Franke argued that inaccessible or uncooperative tools risk pushing researchers toward open-weight systems, where model behavior can be inspected and adjusted more directly.