OpenAI says an upcoming cyber model found and exploited 948 Linux kernel root bugs

OpenAI says a prototype pipeline "powered by an upcoming cyber model" found and exploited 948 unique local privilege escalation (LPE) bugs in the Linux kernel, in a post titled "A thousand fewer paths to root" published on Wednesday 4 November 2026. All figures below are OpenAI's own; our text comes from a reader render of OpenAI's page (r.jina.ai), because openai.com refused our direct request.

What OpenAI says it did

The headline claim, in the post's words: "Our prototype identified and analyzed 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 local privilege escalation (LPE) exploits that could allow an unprivileged local user to gain root access."

The post names the system only as "an upcoming cyber model" and, later, "the newer cyber model". It says the scan ran on "the latest Linux kernel in mid-October 2026". It builds on June's Patch the Planet work, in which OpenAI says "GPT‑5.5 Cyber" developed 24 LPE exploits.

The pipeline, stage by stage

OpenAI describes a pipeline of five stages: vulnerability discovery, dynamic validation, exploitability assessment, patch generation and human review. It gives these counts and API costs by step:

• Vulnerability discovery, Scout agents: 5,034 audit targets, about 2.8 million lines (roughly 7% of the kernel). Cost: $3,426.
• Vulnerability discovery, Analyst agents: 2,308 candidate findings after deduplication, within 12 hours. Cost: $316,549.
• Dynamic validation: 1,724 reproduced in KASAN-instrumented virtual machines, within 30 hours (about 74.7%). Cost: $73,330. The post says "Only 3.1% reflected incorrect analysis by the model"; most of the rest needed elevated privileges or did not reproduce within the time budget.
• Exploitability assessment, initial screening: 313 information leak candidates and 1,238 LPE candidates. Cost: $44,194.
• Exploitability assessment, exploit development: 291 information leak proofs of concept and "1,169 working local privilege escalation exploits", tested with SMEP, SMAP, KASLR and HARDENED_USERCOPY enabled. Cost: $775,929 ($84,929 for leak candidates, $691,000 for LPE candidates). OpenAI says it "performed variant analysis and developed 948 distinct patches for the vulnerabilities behind those exploits", and "We use that number to determine the overall number of unique LPEs".
• Patch generation and human review: the post gives no separate count or cost.

The post puts the end-to-end cost at $1,213,430; on our arithmetic the listed stage figures add to $1,213,428. It also gives unit costs: an average of $359 per successful exploit, $558 per LPE candidate against $271 per leak candidate, and $3,922 each for 69 unsuccessful attempts. It says the costs "are more an upper bound".

What happened to the bugs

OpenAI says "we have already sent out hundreds of reports and patches for critical vulnerabilities" and is working with Patch the Planet partners "to gradually send out patches for the rest". When the scan and manual analysis finished after 10 days, it says, "61 LPEs had already been patched upstream, 43 had staging patches, and 299 were being reported and discussed publicly." The post does not mention CVE identifiers.

Comparisons and caveats

The post compares OpenAI's own models only. It says GPT‑5.6 Sol "found and exploited 166 unique LPE vulnerabilities" in late July for $513,690. On Google's hardened kernelCTF setup, with the SLAB_VIRTUAL mitigation dropped from the config, it reports 21 LPE exploits and 25 leak proofs of concept for about $32,936, and says that if the 21 vulnerabilities were accepted by the programme, the bounty would be around $1.5M. It sets the 21 exploits against "26 confirmed 0-day LPE exploits" kernelCTF has accepted in 2026 at the time of writing. It also puts a "hypothetical valuation" of $18.9M–$66.3M on the 948 exploits using historical Pwn2Own and TyphoonPWN bounties.

The caveats it states:

• In an early run, 20 of 200 reported exploits gained root "through a different 0-day vulnerability" than the one assigned; OpenAI says it then added an independent check.
• First-pass patches could add more code than needed or miss variants.
• The pipeline also found and exploited a QEMU TCG bug in the test infrastructure.

Safety framing

OpenAI frames the work as defensive, part of its Daybreak commitment. It says the work ran "inside a controlled research environment" and that "For safety reasons" it is withholding the full technical details of 10 exploitation techniques that, "To the best of our knowledge", were new. The post does not say who will get access to the upcoming model.

Verification

The post does not cite independent verification of its headline figures; it says only that the techniques were shared with "third-party kernel exploitation experts". On the kernel side, a GitHub search of the torvalds/linux mirror for "openai.com" in commits since 1 October returned 25 commits; 20 carry an openai.com email address, and one reads "Bug found and triaged by OpenAI Security Research and validated by Trail of Bits." None of these commits names the pipeline, so we cannot tie them to OpenAI's tally, and we could not read lore.kernel.org, which blocked our requests.

Why it matters

OpenAI writes that the "operational challenge" of its pipeline "was not discovery, but determining which findings could be reproduced, what security boundary they crossed, and which warranted the earliest maintainer attention." It argues that, on public bounty amounts, the pipeline "was net profitable at the time of this research", and that defenders should proactively analyse their software. On our reading, the figures are self-reported, and the measure for kernel users will be how many of the reports and patches maintainers accept.