Skip to content
audiotale.net
Sign in
NewsNews

OpenAI's AI pipeline built 948 Linux root exploits in one run for $1.2M

OpenAI says an unreleased cyber model reproduced 1,724 kernel bugs and produced 948 working privilege escalation exploits for $1,213,430. What it means for patching.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How it works
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

OpenAI says an autonomous pipeline built on an unreleased cyber model produced 948 working Linux local privilege escalation (LPE) exploits in a single run in mid-October 2026, for $1,213,430 in API credits. The company published the results on 4 November in a report titled "A thousand fewer paths to root". Local privilege escalation bugs let an ordinary logged-in user become root, so the number matters less as a record than as a price: about $1,279 per distinct flaw, by OpenAI's own accounting.

Key points

  • OpenAI says the run analysed 2,308 candidate Linux kernel findings and dynamically reproduced 1,724 of them as real vulnerabilities.
  • It produced 948 working LPE exploits, plus proofs of concept for 291 information-leak bugs, for $1,213,430 in API credits (about $1,279 per LPE).
  • The model is unnamed ("an upcoming cyber model") and unreleased, and the work is described as a prototype with human review before anything is reported to maintainers.
  • OpenAI says its agents used at least 10 exploitation techniques that, to its knowledge, are new, and it is not publishing them.
  • Patch status is partial: a summary of the report says 61 bugs were fixed upstream, 43 had staging patches and 299 were being discussed publicly about ten days after the scan.

What to do

This is research, not an advisory: OpenAI names no CVE IDs, kernel versions or distributions in the coverage we could read, so there is no single update to install.

  • Keep kernels and distribution packages current. OpenAI's own advice, as reported, is that for the near and medium term an unpatched low-privileged account should be treated as roughly equivalent to root against a well-resourced attacker.
  • Shrink who can run code locally. Containers, CI runners, shared hosts and shell accounts are where an LPE bug matters most. Review who has any local login.
  • Watch your distribution's kernel security advisories over the coming weeks, because upstream fixes for this batch are being sent gradually.

What happened

OpenAI's security researchers built a pipeline in which AI agents find, validate, exploit and patch kernel bugs, then a human reviews the output. The Hacker News, summarising the report, describes five stages: discovery of high-value audit targets reachable by low-privileged users; dynamic validation in a sandbox with runtime evidence; exploitability assessment with a written proof of concept; patch generation; and human review of the exploit, the patch and the proposed severity before anything goes to maintainers.

The numbers OpenAI reports for the mid-October run are consistent across the coverage we read:

OpenAI Linux kernel run, mid-October 2026: how many findings survived each stagefindings
OpenAI Linux kernel run, mid-October 2026: how many findings survived each stage (findings)
findings
Candidate findings2308
Reproduced vulnerabilities1724
Working LPE exploits948
Information-leak PoCs291

Source: OpenAI, "A thousand fewer paths to root", as reported by The Hacker News and Startup Fortune

The Hacker News reports the reproduction stage took 30 hours. The exploits target "a commonly used Linux distribution" that the report, as relayed, does not name. The same coverage says the post gives no CVE identifiers.

Background

This is a sequel. In June 2026, according to Startup Fortune, OpenAI launched Patch the Planet, an initiative built with Trail of Bits, HackerOne and Calif, pairing a cyber-specialised model with human security engineers who review every finding. The Hacker News says OpenAI had disclosed 24 LPE exploits in June, found with its GPT-5.5-Cyber model. A July run with a different model, GPT-5.6 Sol, is said in a search summary of OpenAI's report to have found 166 LPEs for about $513,690; we could not open the report to confirm that figure ourselves, so treat it as secondhand.

Outside OpenAI, AI-assisted kernel bug hunting has a public track record. Startup Fortune notes that researcher Sean Heelan used OpenAI's o3 model in May 2025 to find CVE-2025-37899, a remote flaw in the Linux kernel's SMB implementation.

How it works

A summary by the AI/TLDR site of the report gives more detail on the stages; we could not check these against OpenAI's page, so read them as reported. Scout agents picked 5,034 audit targets reachable by low-privilege users (about 7% of the kernel's code). Analyst agents scanned them, triage agents wrote a proof of concept for each finding and ran it in a virtual machine with the Kernel Address Sanitizer until it reproduced, and exploit agents tested the strongest candidates against a stock distribution's protections (SMEP, SMAP and KASLR). The same summary says an early run showed why checks matter: 20 of 200 "successful" exploits reached root through a different zero-day than the one assigned.

Cost by stage, per that summary: exploitation $775,929, candidate discovery $316,549 and validation $73,330, which together come to $1,165,808 of the total; the rest is not itemised in what we read. An average successful exploit cost $359 according to the same source, and OpenAI calls its cost figures an upper bound.

The Hacker News reports at least ten novel exploitation techniques: two new persistent elastic objects for spraying objects into the kernel cache, two page-grooming techniques for reliability, five data-only techniques for privilege escalation, and one arbitrary type-confusion technique.

What it means

For defenders. The headline economics: RuntimeWire says OpenAI values the same set of bugs at $18.9 million to $66.3 million at historical bounty rates, and AI/TLDR puts that at 16x to 55x the run's cost. Those comparisons are OpenAI's framing, not an independent valuation. If the framing is right, rescanning old code each time models improve becomes a budget decision rather than a staffing limit.

For attackers. The same arithmetic applies to offence, which is OpenAI's own caveat: faster discovery has to be matched by faster patch generation to shrink the exploitation window. Other reporting points the same way. The Hacker News cites Google Threat Intelligence Group figures that monthly vulnerability disclosures rose from 5,045 in January 2026 to 10,740 in August 2026, and the UK NCSC's assessment that AI tools have very likely significantly increased zero-day discovery. We have not checked those two against their own pages.

For kernel maintainers. A flood of valid reports is its own problem. OpenAI says it followed the kernel community's advice to start with critical bugs and send the rest gradually, with human review first.

What we don't know yet

  • The model. OpenAI gives no name or release date.
  • How many patches are accepted. Startup Fortune says every exploit has a patch attached, while The Hacker News says the report does not confirm how many patches were produced or accepted. Only the ten-day snapshot (61 / 43 / 299) is available, and only via a summary.
  • Independent verification. All figures come from OpenAI. No outside party has reproduced the run in the coverage we read.
  • The distribution and kernel version. Not named in what we could read.
  • Whether "948" counts distinct bugs or exploits. Outlets use both words; RuntimeWire says "distinct" flaws.

We could not open OpenAI's own page (it sits behind a browser check), so the report's wording is taken from the outlets below. Every figure in this article appears in at least two of them unless marked as secondhand.

What to watch next

  • Kernel stable-release notes and your distribution's advisories for fixes tied to this batch.
  • Whether OpenAI names the model and opens it to defenders.
  • Independent security researchers testing the claim that these exploits cost a few hundred dollars each.
  • Whether other labs publish comparable end-to-end numbers.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next