OpenAI pipeline built 948 Linux kernel root exploits for $1.2 million

8 min read

OpenAI says an autonomous pipeline driven by an upcoming, unnamed cyber model produced working root exploits for 948 distinct local privilege escalation vulnerabilities in the Linux kernel during a single run in mid-October 2026. The company described the work in a research post titled "A thousand fewer paths to root" and in a post on its official X account on November 4, saying the pipeline discovered, validated, exploited and generated patches for the flaws at a total API cost of $1,213,430, which OpenAI puts at about $1,279 for each distinct vulnerability.

The run targeted the latest Linux kernel on virtual machines running a stock desktop distribution that OpenAI describes only as commonly used, with standard kernel protections switched on, including KASLR, SMEP, SMAP and HARDENED_USERCOPY. According to OpenAI, the agents started from 2,308 candidate findings, reproduced 1,724 of them in isolated machines and ended with 1,169 working root exploits and 291 information-leak proofs of concept, which variant analysis grouped into the 948 unique kernel vulnerabilities.

OpenAI has not named the model, given it a release date or said how it will be offered. The company states that security researchers review every exploit, patch and proposed severity rating before anything reaches kernel maintainers, that it has already sent hundreds of reports and patches starting with the most serious flaws, and that it is working through the rest with partners in its Patch the Planet program. It is withholding the technical details of the exploitation techniques the agents used.

··········

HOW THE OPENAI LINUX KERNEL PIPELINE WORKS, STAGE BY STAGE.

OpenAI describes a five-stage agentic system covering vulnerability discovery, dynamic validation, exploitability assessment, patch generation and human review. The first agents, which the company calls scouts, mapped the kernel and selected the code that an unprivileged local user can reach. They settled on 5,034 audit targets totalling about 2.8 million lines of code, roughly 7% of a kernel that OpenAI says exceeds 40 million lines.

Analyst agents then examined those targets and produced 2,308 unique candidate findings within twelve hours. Triage agents wrote programs designed to crash the kernel through each suspected bug and ran them in isolated virtual machines with the KASAN memory error detector active. Within 30 hours they reproduced 1,724 vulnerabilities, a confirmation rate of 74.7%. OpenAI says that among the candidates that could not be confirmed, 3.1% rested on flawed reasoning by the model, while the rest depended on race conditions whose timing is hard to trigger on demand.

Exploit-development agents then attacked the confirmed bugs on the hardened desktop machines and delivered 291 information-leak proofs of concept and 1,169 working root exploits. Because several exploits can reach root through the same underlying flaw, OpenAI grouped them by root cause and arrived at the headline figure of 948 distinct vulnerabilities.

........

Pipeline stage	Output reported by OpenAI	Time
Scout agents	5,034 targets, about 2.8M lines (7% of the kernel)	not disclosed
Analyst agents	2,308 candidate findings	12 hours
Triage agents in VMs with KASAN	1,724 reproduced vulnerabilities (74.7%)	30 hours
Exploit-development agents	1,169 root exploits, 291 info-leak PoCs	not disclosed
Variant analysis	948 distinct root vulnerabilities	full run cost $1,213,430

........

Read as a funnel, about 41% of the original candidate findings ended up as distinct, exploitable root vulnerabilities, and roughly three in four candidates survived dynamic reproduction. Dividing the full budget by the 948 distinct vulnerabilities gives just under $1,280 each, in line with the company's own figure, while dividing it by the 1,169 individual working exploits gives about $1,038 per exploit.

··········

OPENAI CYBER MODEL RESULTS COMPARED WITH THE JUNE AND JULY RUNS.

The October campaign is the third step in a series OpenAI has run against the kernel under its Patch the Planet effort, which we covered when OpenAI launched it as a global vulnerability response program. In June 2026, OpenAI says, GPT-5.5-Cyber found kernel bugs and built 24 local root exploits to verify its reports. In July, a scan with GPT-5.6 Sol found and exploited 166 unique local privilege escalation vulnerabilities for $513,690 in API credits.

........

Kernel run	Model	Distinct root vulnerabilities	API cost	Cost per vulnerability
June 2026	GPT-5.5-Cyber	24 exploits built	not disclosed	not disclosed
July 2026	GPT-5.6 Sol	166	$513,690	about $3,095
October 2026	Unnamed upcoming cyber model	948	$1,213,430	about $1,280

........

Between July and October the number of distinct root vulnerabilities rose by a factor of about 5.7, while total spending rose by a factor of about 2.4. The cost per vulnerability therefore fell by roughly 59%, from about $3,095 to about $1,280. OpenAI points out that the October result came after three more months of upstream kernel hardening, so the later run faced a harder target. The two runs differ in model, scope and tooling, and OpenAI has not published a like-for-like benchmark between them, so the comparison describes the company's reported outcomes rather than a controlled test of the two models.

OpenAI also ran the pipeline against an adapted version of Google's kernelCTF environment, a hardened kernel with a reduced attack surface that Google uses for its exploit reward program. Over 112 hours and $32,936 in credits, the agents produced 21 privilege escalation exploits and 25 information-leak proofs of concept, about $1,568 per root exploit. OpenAI notes that kernelCTF had accepted 26 confirmed zero-day privilege escalation exploits in all of 2026 at the time of the research, and estimates that the 21 exploits would be worth about $1.5 million under that program's payouts, which led the company to describe the pipeline as "net profitable at the time of this research."

··········

NEW LINUX EXPLOITATION TECHNIQUES AND OPENAI'S VALIDATION CHECKS.

OpenAI says that when its researchers sampled 166 of the exploits, they found at least ten exploitation techniques that, to their knowledge, had not been documented before, and that outside kernel exploitation experts consulted by the team also considered them new. The company lists them only by category: two new persistent "elastic" kernel objects usable for cache spraying, two page grooming techniques, five data-only privilege escalation methods and one arbitrary type confusion technique. The details are being held back for safety reasons.

The company is open about a failure mode it hit along the way. In an early run, the exploitation stage claimed 200 working root exploits, but human review found that 20 of them reached root by triggering a different zero-day than the one the agent had been assigned. OpenAI responded by tightening task rules and adding an independent check that confirms each exploit uses its intended bug. The episode shows why the company keeps people in the loop, since an agent rewarded for reaching root will take any path that works, including one nobody asked it to find.

OpenAI also argues that automated patch generation is essential "to secure software at the pace required, and to limit the exploitation window," and says AI-written patches can be functionally correct, follow existing code style and resist attack variants when experts guide the iteration. It has not published acceptance rates or quality metrics for the patches produced in this run.

··········

WHAT THE OPENAI FINDINGS MEAN FOR LINUX ADMINISTRATORS AND SECURITY TEAMS.

The practical message from OpenAI is blunt. The company says that, at least in the near and medium term, an unpatched operating system account with low privileges should be treated as "functionally equivalent to root access for a well-resourced threat actor." That assumption changes how teams should think about shared servers, developer workstations, CI runners, multi-tenant hosts and any system where untrusted users or code get a local shell.

OpenAI's own recommendations are layered defenses, namely applying kernel updates quickly as fixes land and isolating untrusted workloads with sandboxing tools such as Firecracker and gVisor so that a kernel bug inside a sandbox does not hand over the host. For security teams, the concrete steps that follow are to shorten kernel patch cycles across fleets, to reduce the number of systems where untrusted users have local accounts at all, and to monitor distribution security advisories closely over the coming weeks, since OpenAI says the remaining reports and patches are still being sent through Patch the Planet partners.

On the state of fixes, OpenAI reports that ten days after the scan began, 61 of the privilege escalation bugs had been patched upstream, 43 had patches in staging and 299 were being reported or discussed in public kernel channels. The company has not said how many of those fixes came directly from its own submissions and how many from independent work by kernel developers, and it has not published CVE identifiers or the exact kernel versions tested. Administrators therefore cannot yet map the 948 vulnerabilities to specific advisories, and the safest assumption is that many of them remain unfixed in shipping distributions today.

For developers and companies following OpenAI's security products, the model behind the run is not available. OpenAI calls it an upcoming cyber model and has given no name, price, access program or date. The announcement follows the company's recent move to raise bug bounty payouts and prepare a new internal security sprint, which we reported earlier this week, and lands a month after our report on Claude and 6,157 vulnerabilities in 591 open-source projects, as the large labs compete to show what their models can do in automated vulnerability research.

··········

THE BOUNTY VALUE OPENAI ATTACHES TO 948 KERNEL EXPLOITS.

To give the cost figure some scale, OpenAI compared the run with what competitions have historically paid for Linux kernel privilege escalation exploits, using $20,000 per exploit at Pwn2Own and $70,000 at TyphoonPWN. Applied to 948 vulnerabilities, those rates give a hypothetical value between about $18.9 million and $66.3 million, or roughly 16 to 55 times the $1.21 million the run cost in API credits.

That comparison is illustrative and OpenAI presents it as such. No competition would accept 948 Linux entries in a single cycle, bounty programs pay for exploits against specific hardened targets under strict rules, and the market price of a vulnerability falls quickly once many similar bugs exist. The kernelCTF estimate of about $1.5 million for 21 exploits, against $32,936 in credits, is a tighter reference because it uses a real program's target and rules, and it points the same way. On OpenAI's numbers, finding and weaponizing kernel bugs with frontier models is now far cheaper than the rewards defenders have traditionally offered for them.

The same arithmetic applies to attackers. OpenAI predicts that within a few years frontier models will routinely find vulnerabilities in software projects, and that less capable models may be able to build exploits once vulnerabilities are disclosed. Its argument for publishing the numbers is that defenders need to plan for that cost curve now, with faster patching and stronger isolation, while the most capable cyber models remain under the control of the companies that train them.

··········

OPENAI LINUX KERNEL EXPLOIT RESEARCH: CONFIRMED FACTS AND OPEN QUESTIONS.

The figures in this report come from OpenAI's own research post and its official X account. On the company's account, a single mid-October run with an unreleased cyber model reproduced 1,724 kernel vulnerabilities, produced 1,169 working root exploits mapping to 948 distinct flaws on a hardened desktop distribution, and cost $1,213,430 in API credits. OpenAI also reports at least ten exploitation techniques it believes are new, a kernelCTF run with 21 root exploits for $32,936, and a cost per vulnerability that fell by close to 60% compared with its July scan using GPT-5.6 Sol.

Several points remain undisclosed. OpenAI has not named the model or said whether and how it will be released, has not identified the distribution or kernel versions tested, has not published CVE identifiers or patch acceptance rates, and has not detailed how many of the upstream fixes came from its own reports. The exploitation techniques are withheld. Until those details appear, the 948 figure is best read as OpenAI's account of what its internal pipeline achieved, reviewed by its own researchers and a group of outside experts, rather than an independently audited result. For Linux operators the immediate consequence is the one OpenAI states directly, that low-privilege local access on an unpatched kernel should be treated as a path to root.

··········

·····

DATA STUDIOS

·····

datastudios.org