{"id":"https://openalex.org/W7225389504","doi":"https://doi.org/10.5281/zenodo.24014225","title":"TWENTY OF TWO HUNDRED : On the 948 Root Escalations, the Path That Was Wrong, and the Boundary That Was Absent","display_name":"TWENTY OF TWO HUNDRED : On the 948 Root Escalations, the Path That Was Wrong, and the Boundary That Was Absent","publication_year":2026,"publication_date":"2026-11-06","ids":{"openalex":"https://openalex.org/W7225389504","doi":"https://doi.org/10.5281/zenodo.24014225"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.24014225","doi":"https://doi.org/10.5281/zenodo.24014225","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24014225","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.24014225","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5065760978","display_name":"M. TAALABI","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Taalabi, M.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5146454151","display_name":"Team LLM-DIPLOMAT","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"LLM-DIPLOMAT, Team","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8521000146865845,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8521000146865845,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.054499998688697815,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.020500000566244125,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/linux-security","display_name":"Linux security","score":0.5},{"id":"https://openalex.org/keywords/vulnerability-detection","display_name":"vulnerability detection","score":0.38499999046325684},{"id":"https://openalex.org/keywords/patching","display_name":"patching","score":0.5070000290870667},{"id":"https://openalex.org/keywords/system-boundaries","display_name":"system boundaries","score":0.5429999828338623},{"id":"https://openalex.org/keywords/unbounded-systems","display_name":"unbounded systems","score":0.6629999876022339},{"id":"https://openalex.org/keywords/security-specifications","display_name":"security specifications","score":0.42399999499320984}],"concepts":[{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.8022000193595886},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.7581999897956848},{"id":"https://openalex.org/C171078966","wikidata":"https://www.wikidata.org/wiki/Q111029","display_name":"Root (linguistics)","level":2,"score":0.6711999773979187},{"id":"https://openalex.org/C34388435","wikidata":"https://www.wikidata.org/wiki/Q2267362","display_name":"Bounded function","level":2,"score":0.656000018119812},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.6359999775886536},{"id":"https://openalex.org/C2780428219","wikidata":"https://www.wikidata.org/wiki/Q16952335","display_name":"Cover (algebra)","level":2,"score":0.5651999711990356},{"id":"https://openalex.org/C114614502","wikidata":"https://www.wikidata.org/wiki/Q76592","display_name":"Combinatorics","level":1,"score":0.42590001225471497},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.3921000063419342},{"id":"https://openalex.org/C148220186","wikidata":"https://www.wikidata.org/wiki/Q7111912","display_name":"Outcome (game theory)","level":2,"score":0.32109999656677246},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.2994999885559082},{"id":"https://openalex.org/C118615104","wikidata":"https://www.wikidata.org/wiki/Q121416","display_name":"Discrete mathematics","level":1,"score":0.29440000653266907},{"id":"https://openalex.org/C162329640","wikidata":"https://www.wikidata.org/wiki/Q332648","display_name":"Covering space","level":2,"score":0.2928999960422516},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.28999999165534973},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.28679999709129333},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.28380000591278076},{"id":"https://openalex.org/C2777686260","wikidata":"https://www.wikidata.org/wiki/Q144037","display_name":"Calculus (dental)","level":2,"score":0.27559998631477356},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.2694000005722046}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.24014225","doi":"https://doi.org/10.5281/zenodo.24014225","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24014225","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},{"id":"doi:10.5281/zenodo.24014226","doi":"https://doi.org/10.5281/zenodo.24014226","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24014226","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"}],"best_oa_location":{"id":"doi:10.5281/zenodo.24014225","doi":"https://doi.org/10.5281/zenodo.24014225","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24014225","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7128541496","https://openalex.org/W7219839695","https://openalex.org/W7204159681","https://openalex.org/W86713893","https://openalex.org/W7164566741","https://openalex.org/W4396786871","https://openalex.org/W7097916929","https://openalex.org/W6989831489","https://openalex.org/W7039430421","https://openalex.org/W7203702394"],"abstract_inverted_index":{"An":[0,81,179],"OpenAI":[1],"agent":[2],"found":[3],"948":[4,183],"unique":[5,20],"local":[6],"privilege":[7],"escalation":[8],"vulnerabilities":[9],"in":[10,185],"Linux,":[11],"from":[12],"1,169":[13],"exploit":[14],"runs,":[15],"at":[16],"roughly":[17],"$1,279":[18],"per":[19],"vulnerability.":[21],"https:/www.threads.com/share/BAQLeidudp":[22],"It":[23,45],"also":[24],"wrote":[25],"patches":[26,162],"for":[27],"some.":[28],"The":[29,38,69,73,98,118,125,133,143],"patcher":[30],"and":[31,91,107,169,186],"the":[32,35,66,79,89,113,123,131,138,147,172,177],"burglar":[33],"are":[34,122],"same":[36],"machine.":[37],"number":[39],"that":[40,87,94],"matters":[41],"is":[42,46,78,100,104,109,130,135,145],"not":[43,105,110,136,175],"948.":[44],"twenty.":[47],"Out":[48],"of":[49,127],"two":[50],"hundred":[51],"reported":[52],"rootescalations":[53],"reviewed":[54],"by":[55],"human":[56],"auditors,":[57],"twenty":[58,119],"were":[59],"achieved":[60],"via":[61],"a":[62,85,92,128,150],"completely":[63],"diferentvulnerability":[64],"than":[65],"one":[67],"assigned.":[68],"outcome":[70],"was":[71,75,158,165],"correct.":[72],"path":[74,93,99],"wrong.":[76],"That":[77],"thesis.":[80],"unbounded":[82,180],"system":[83],"produces":[84],"result":[86],"satisfies":[88],"objective":[90],"cannot":[95,115,187],"be":[96,141],"reconstructed.":[97],"invisible":[101],"because":[102,112],"it":[103,108,157,164],"specified,":[106],"specified":[111,159,166],"architecture":[114],"specify":[116],"it.":[117],"wrong":[120],"paths":[121],"proof.":[124],"absence":[126],"boundary":[129],"cause.":[132],"question":[134,144],"whether":[137,146],"machine":[139,148,154,181],"should":[140],"released.":[142],"has":[149],"boundary.":[151],"A":[152],"bounded":[153],"finds":[155,182],"what":[156,163],"to":[160,167],"find,":[161],"patch,":[168],"refuses":[170],"when":[171],"specification":[173],"does":[174],"cover":[176],"input.":[178],"ways":[184],"tell":[188],"you":[189],"how.":[190]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-11-07T00:00:00"}