OpenAI says an autonomous pipeline built on an upcoming cyber model validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel, at an API cost of $1.2 million. The company described the work on November 4 in a research post titled "A thousand fewer paths to root."
A local privilege escalation (LPE) bug lets an unprivileged local user gain root access. OpenAI ran its prototype in a controlled research environment and says human researchers reviewed the output before anything was reported to maintainers.
What the pipeline did
OpenAI's post describes five stages: vulnerability discovery, dynamic validation, exploitability assessment, patch generation and human review. Each stage is run by agents, except the last.
- Discovery. Scout agents picked audit targets that low-privileged users can reach. OpenAI says this produced 5,034 audit targets, about 2.8 million lines of code, roughly 7% of the kernel code base. Analyst agents then produced 2,308 candidate findings after deduplication within 12 hours.
- Validation. A triage agent built a proof of concept for each candidate and ran it in an isolated virtual machine with the Kernel Address Sanitizer. Within 30 hours, the system reproduced 1,724 vulnerabilities, about 74.7% of the 2,308 candidates, according to the post.
- Exploitability. Exploit-development agents tested candidates on virtual machines with standard Linux protections turned on. OpenAI lists SMEP, SMAP, KASLR and HARDENED_USERCOPY. The agents produced 291 proofs of concept for information leaks and 1,169 working local privilege escalation exploits.
- Patching. OpenAI performed variant analysis and developed 948 distinct patches for the vulnerabilities behind those exploits, and it uses that number as its count of unique LPEs.
- Human review. Security researchers review the exploit, patch and proposed severity before reporting to maintainers.
The target virtual machines ran a stock desktop operating system, OpenAI says, and the run took place in mid-October 2026 on the latest Linux kernel.
The cost
OpenAI reports the whole run cost $1,213,430 in API credits, or $1,279 per LPE exploit. By stage, exploitation cost $775,929 in total, the analyst scan cost $316,549 and validation cost $73,330. OpenAI says it focused on methodology and measuring model capability, not cost, and that the figures are "more an upper bound."
The company also compared the run with bug bounty payouts. It says Pwn2Own and TyphoonPWN historically offered $20,000 and $70,000 for Linux kernel LPE exploits, and that applying those amounts to the 948 exploits gives a hypothetical valuation of $18.9M to $66.3M. That is a comparison OpenAI draws, not money anyone was paid.
On an adapted kernelCTF environment, a Linux kernel with reduced attack surface, the pipeline obtained 25 information leak proofs of concept and 21 LPE exploits at a cost of roughly $32,936 in API credits.
A stronger model found more
OpenAI says the same approach found fewer bugs with an earlier model. In late July 2026, GPT-5.6 Sol found and exploited 166 unique LPE vulnerabilities at an end-to-end cost of $513,690. The mid-October run with the newer cyber model found 948 for $1,213,430. Both scans targeted the latest Linux kernel master branch at the time.
The post also says the agents used at least 10 novel Linux exploitation techniques, which OpenAI shared with third-party kernel exploitation experts, and that it omitted the technical details for safety reasons.
Caught mistakes
OpenAI included a cautionary note about agent-run security research. In an early run, the exploitation stage reported 200 successful LPE exploits. After human review, 20 of them had reached root through a different 0-day vulnerability than the one assigned. OpenAI then tightened the task constraints and added an independent check that each final exploit used its assigned vulnerability.
For readers following how OpenAI supervises its agents more broadly, see our report on how OpenAI monitors its AI agents for misalignment.
What happens to the findings
OpenAI says it began with critical vulnerabilities, following guidance from the Linux kernel community, and has sent out hundreds of reports and patches. It is working with Patch the Planet partners to send the rest gradually. Patch the Planet is a Daybreak initiative to support open-source maintainers. Daybreak also includes Daybreak Red, which gives approved customers access to OpenAI's cybersecurity models. Our post on Daybreak Red in AWS GovCloud covers how access works.
Maintainers were already moving. By the time the autonomous scan and manual analysis finished after 10 days, OpenAI says 61 LPEs had been patched upstream, 43 had staging patches and 299 were being reported and discussed publicly.
Why it matters
OpenAI's own takeaway is blunt. It writes that for the near and medium term, "having access to a low-privileged account on an operating system, that isn't up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor." Its advice is to keep systems patched and to use isolation such as Firecracker and gVisor to limit the damage from an exploited vulnerability.
For related coverage of AI-built exploits, see our post on Claude building exploit chains for Chrome, Safari and Linux. For what people said about the release on Hacker News and X, see our roundup of reactions to the pipeline.
The figures are OpenAI's own and the pipeline uses a model OpenAI describes only as upcoming, so the numbers rest on OpenAI's account of its own run. OpenAI says it reports per-stage costs so that researchers can assess the resources needed to reproduce and extend the work.
