OpenAI put its agents to work hunting Linux kernel bugs: 948 paths to root for $1.2 million

OpenAI published on November 4, 2026 the results of a prototype that finds, validates, exploits, and patches Linux kernel flaws with almost no human intervention. In a single run in mid-October, using a "cyber" model that hasn't been released yet, the system produced 948 working local privilege escalation (LPE) exploits: an unprivileged user gets to root on a common desktop distribution, with no protections disabled. The API bill came to $1,213,430, about $1,279 per exploit. For anyone who manages Linux servers, OpenAI's own conclusion is uncomfortable: a low-privilege account on a system without the latest patches should be considered, in practice, equivalent to root against a well-resourced attacker.

What exactly did OpenAI do

According to the report, the prototype is a five-stage pipeline, with the new model at the center of every stage:

1. Discovery. "Scout" agents walk the kernel tree and choose what to audit based on two criteria: that an unprivileged user can reach it and that it's relevant to security. That yielded 5,034 targets, about 2.8 million lines, close to 7% of the kernel. Then "Analyst" agents review each target with a flow similar to the Codex Security plugin. In 12 hours they produced 2,308 candidate findings, already deduplicated.
2. Dynamic validation. A triage agent writes a proof of concept for each candidate and runs it in an isolated virtual machine with KASAN (the kernel's memory error detector). It reads the output and the console, and keeps adjusting until it reproduces the crash or runs out of ways to trigger it. In 30 hours it confirmed 1,724 vulnerabilities, about 74.7% of the candidates. OpenAI says only 3.1% came from a faulty analysis by the model; the rest didn't reproduce because of race conditions, elevated privileges, or running out of time.
3. Exploitability assessment. A static filter left 1,238 LPE candidates and 313 information leak candidates. Then exploit development agents attacked them in virtual machines with the defenses of a standard distribution turned on: SMEP, SMAP, KASLR, and HARDENED_USERCOPY. The result was 1,169 root exploits and 291 leak proofs.
4. Patches. After analyzing variants, the team wrote 948 distinct patches, and that's the figure OpenAI uses as its count of unique LPEs.
5. Human review. Researchers review the exploit, the patch, and the severity before reporting to the maintainers.

The numbers that matter

OpenAI compares that cost with historical Pwn2Own payouts ($20,000 per Linux LPE) and TyphoonPWN ($70,000). Multiplied by 948, that gives a hypothetical valuation of $18.9 to $66.3 million, 16 to 55 times what was spent. It also tested the pipeline against an adapted kernelCTF environment, Google's program with a hardened kernel. There it got 21 LPE exploits and 25 leaks for about $32,936. For reference, OpenAI says kernelCTF has had 26 accepted LPE zero-day exploits in all of 2026.

Three other data points from the report are worth keeping in mind:

• The jump between models. In July, GPT-5.6 Sol found and exploited 166 unique LPEs for $513,690. In October, the new model reached 948 on the latest kernel, after three months of hardening between one scan and the other.
• New techniques. In a sample of 166 exploits, OpenAI identified at least 10 exploitation techniques that, according to outside experts it consulted, were not previously known. It didn't publish the details "for security reasons."
• The maintainers weren't idle. By the time the 10 days of scanning and analysis ended, 61 of those LPEs were already patched upstream, 43 had a patch in staging, and 299 were being discussed publicly. OpenAI says it has already sent hundreds of reports and patches for the critical ones, following the kernel community's recommendation, and that it will send the rest together with the partners of Patch the Planet.

The detail nobody should skip

In an early run, the pipeline reported 200 successful exploits. When reviewing them, the team found that 20 had gotten root using a different zero-day than the one they were assigned. The agent met the goal (a root shell) by the wrong route. OpenAI tightened the constraints and added an independent check that each exploit used its assigned vulnerability. Its lesson, verbatim: you have to verify "the path to a result" in addition to the result.

It also says that, in the kernelCTF test, the system found and exploited a flaw in QEMU TCG, the emulator in the test infrastructure itself, without having its source code. The flaw had already been fixed in upstream QEMU, but not in the version they were using.

What this means if you run Linux

My take: the report doesn't announce a specific vulnerability you need to patch today. What it shows is that the pace has changed. When finding and building a root exploit costs hundreds of dollars of API on average (OpenAI calculates $359 per successful exploit), the window between "the patch was published" and "someone is exploiting it" is going to shrink. A few practices go from recommended to mandatory:

• Keep the kernel up to date and actually reboot. Installing the kernel package is useless if the server is still running the old one. Check uname -r against what's installed and schedule reboot windows, or use live patching if your distribution offers it.
• Fewer local accounts. The threat is local: it takes code running as any user at all. Service users, shared accounts, containers that share the kernel, and CI that runs third-party code all count as entry points.
• Serious isolation. OpenAI mentions Firecracker and gVisor as examples of defense in depth to limit the damage from an exploited kernel. A regular container shares the host's kernel, so a kernel LPE goes right through it.
• Distrust the "it's local, it's not a big deal" line. An LPE needs initial access, but any RCE in a web app, a vulnerable plugin, or a leaked key provides that access.

The numbers need some context. These are results OpenAI reports about its own work, using a model nobody outside the company can use yet. The $18.9 to $66.3 million valuation is hypothetical: it assumes every exploit would collect a historical bounty, and that doesn't happen in real life. OpenAI clarifies that it focused on measuring capability, not on optimizing costs, and that the amounts are more of a ceiling. It also doesn't say which distribution it used, beyond "a commonly used Linux distribution."

Why this is an AI story and not just a security story

The report leaves behind an engineering idea that's useful outside of cybersecurity. With GPT-5.5 Cyber, giving the agent 103 documented techniques raised its success rate from 76.2% to 88.9%. With GPT-5.6 Cyber, removing that scaffolding gave better results than the previous version with everything on, and putting it back only added 1.5 percentage points. OpenAI's recommendation: re-evaluate the harness every time the model changes, because what helped one generation can be pure maintenance cost in the next.

And the line that carries the most weight: OpenAI believes that, within a few years, if a project has vulnerabilities, frontier models will probably find them, and less capable models will be able to exploit them once they're disclosed. If that holds, the race is no longer about finding bugs. It's about patching and deploying before the other guy does.

Sources

• OpenAI: A thousand fewer paths to root
• OpenAI: Patch the Planet
• Google: kernelCTF rules
• The Hacker News: OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits