AI found a 15-year Linux flaw, while another system wrongly flagged a reporter as a car thief

Two AI-driven incidents published in the same discussion show opposite outcomes from the same basic process: pattern recognition, automated judgment, and action. Security firm Nebula Security said its AI-assisted bug hunting tool, VEGA, uncovered GhostLock, a Linux kernel vulnerability tracked as CVE-2026-43499. According to the company’s July 7, 2026 technical report, the flaw dates back to 2011 and affects nearly all major Linux distributions. Nebula said it built a privilege-escalation chain with a 97% success rate and could move from a normal user account to root in about five seconds on a test machine. Google’s KernelCTF awarded the team $92,337. The other case involved auto journalist Joel Feder, who was surrounded by four police vehicles after an entry mistake in the U.S. stolen vehicle database was compounded by AI-powered license plate recognition from Flock. A stolen plate entered as “34 DTM” instead of “34 03 DTM” was matched against Feder’s dealer plate, “34 10 DTM,” because the system failed to read the small middle digits. The article argues the contrast is not about AI being good or bad on its own. In one case, the input was accurate code and the system exposed a real problem. In the other, bad source data traveled through a nationwide network and was acted on at machine speed.