OpenAI’s security team set its AI loose on the Linux kernel and came back with a number that sounds made up: 948. In a single 10-day run in mid-October 2026, an autonomous pipeline built on an upcoming cyber model found, reproduced and exploited 948 distinct local privilege-escalation vulnerabilities in the Linux kernel, bugs that let an ordinary user account take over a machine as root. OpenAI published the results Wednesday, November 4, in a research post titled “A thousand fewer paths to root.” The whole run cost $1,213,430 in API credits, or about $1,279 per working exploit.
The OpenAI Linux kernel vulnerabilities were not found by one model chatting its way through source code. Five groups of agents split the job the way a human security team would, except they never slept. Scout agents picked out the parts of the kernel a low-privileged user can actually reach, narrowing roughly 40 million lines of code down to 5,034 audit targets, about 2.8 million lines, or 7 percent of the kernel. Analyst agents read those targets and produced 2,308 candidate findings inside 12 hours. Triage agents then tried to trigger each one in isolated virtual machines and managed to reproduce 1,724 of them, about 74.7 percent, within 30 hours.
That’s the scale that makes this different from a demo.
Exploit-development agents took the most promising bugs and tested them on machines running the standard protections of a regular Linux distribution, including SMEP, SMAP, KASLR and HARDENED_USERCOPY. They produced 291 proofs of concept for information leaks and 1,169 working root exploits. After grouping exploits that traced back to the same flaw, OpenAI counted 948 distinct vulnerabilities, each with a candidate patch attached. Human researchers reviewed the evidence before anything went to kernel maintainers, and OpenAI kept the technical details out of its post for safety reasons.
How the OpenAI Linux kernel pipeline works
The pipeline runs in five stages: discovery, dynamic validation, exploitability assessment, patch generation and human review. No single stage is new on its own. What changed is that the stages now run end to end without a person in the loop between them, so a hunch found in the morning can be a working root shell by the afternoon.
OpenAI has been building toward this all year. Its Daybreak program launched Patch the Planet in June 2026 with Trail of Bits, HackerOne and open-source maintainers, and an earlier run with GPT-5.5 Cyber produced 24 working local privilege-escalation exploits. A July run of the same harness with GPT-5.6 Sol found 166 unique flaws for $513,690. Three months later, the newer cyber model found more than five times as many, at less than half the cost per bug.
The pipeline also got tested on a harder target. On an adapted version of Google’s kernelCTF, a hardened kernel with a reduced attack surface, it produced 21 privilege-escalation exploits and 25 information-leak proofs of concept over 112 hours and $32,936 in API credits. That matters because kernelCTF is designed to be difficult, and the system still got root.
What the run cost, and what the bugs were worth
OpenAI priced its haul the way the market would. Pwn2Own and TyphoonPWN, the big hacking contests, have historically paid $20,000 to $70,000 for a Linux kernel privilege-escalation bug. At those rates, the 948 flaws are worth somewhere between $18.9 million and $66.3 million, or 16 to 55 times what the run cost. OpenAI called the $1.2 million figure “more an upper bound” and said it expects better harness engineering to cut the cost per stage.
Sampling 166 of the exploits, OpenAI’s analysts identified 10 exploitation techniques they believe are new, including fresh ways to spray objects into a target cache and data-only paths to root. Outside kernel experts who had not seen the techniques before agreed they looked new, though independent confirmation will need the technical detail OpenAI has withheld.
The catch: 948 patches, not 948 fixes
A candidate patch is not a shipped fix. When the scan and manual analysis wrapped up after 10 days, 61 of the flaws had been patched upstream, 43 had patches in staging and 299 were being reported and discussed publicly. The rest still need review and integration before they become updates anyone can install, and which machines are affected depends on their kernel version and configuration.
That gap is the whole story for defenders. The kernel powers Android phones, cloud servers and supercomputers, and its attack surface runs through system calls, networking, filesystems and device drivers. Finding bugs faster than maintainers can fix them does not make anyone safer on its own. It just moves the bottleneck.
OpenAI is not the only lab pushing in this direction. The post landed weeks after Anthropic said Claude had found and exploited a Linux kernel flaw on its own, and OpenAI has now made Daybreak Red, with its GPT-5.6 Cyber model, available to approved security teams through AWS GovCloud for authorized defensive work. The tools are going out to defenders first, but the same capability in other hands is the obvious worry, and OpenAI’s decision to withhold exploit details reads as an acknowledgment of that.
Why this matters
Bug hunting used to be a craft job, limited by how many skilled humans you could hire and how long they could stare at code. This run suggests the limit is now compute budget. At $1,279 a bug, a well-funded team can find flaws at a pace no human group can match, and the price is still falling: the July run cost $3,095 per bug, and the October run cost less than half that.
Nobody’s machine is patched yet.
The question is no longer whether AI can find vulnerabilities at scale. It can, and OpenAI just showed the receipts. The question is whether the people who fix software can keep up with the machines that now break it, and whether the fixes land before the same techniques show up somewhere they were never meant to.
Frequently asked questions
How many Linux kernel vulnerabilities did OpenAI’s AI find?
OpenAI’s autonomous pipeline found 948 distinct local privilege-escalation vulnerabilities in the Linux kernel during a 10-day run in mid-October 2026, each with a working exploit and a candidate patch.
How much did OpenAI’s Linux kernel bug hunt cost?
The run cost $1,213,430 in API credits, about $1,279 per working exploit. OpenAI said that figure is “more an upper bound” because the team was measuring capability, not optimizing spend.
Are the 948 Linux flaws fixed now?
No. The pipeline produced candidate patches, not shipped fixes. When the run wrapped up, 61 flaws had been patched upstream, 43 had patches in staging, and 299 were still being reported and discussed.
What is a local privilege-escalation vulnerability?
It is a bug that lets code already running with limited permissions gain root access, the highest level of control on a machine. Attackers need some foothold first, but after that the flaw hands them the keys.
Sources: OpenAI, HelpNetSecurity, Dealroom