Trail of Bits uses Codex to backport security patches for stable Linux, covering 149 CVEs
Trail of Bits used Codex together with GPT-5.6 to backport security patches for the stable Linux kernel and distributions. As of October 29, it had delivered fixes for 149 CVEs to stable kernel branches, plus several Fedora and Ubuntu package fixes. In its workflow, the agent identifies missing fixes, adapts patches, assembles verification evidence, runs tests, and prepares submission materials, while engineers review and submit them to maintainers; excluding initial project setup, a simple backport requires about 30 minutes of human effort, and complex cases about 3 hours. The authors also provide the number of CVEs fixed in newer versions but not backported in each stable branch of the Linux kernel and in Debian 13 and Ubuntu 26.04, and note that regression testing and maintainer acceptance remain necessary steps.
Why read thisTrail of Bits has disclosed the specific workflow and human effort involved in using Codex to backport security patches, which can be used to assess the feasibility of AI agents taking on legacy security work.
