OpenAI says one automated run produced 948 working root exploits for the Linux kernel and a candidate patch for each flaw behind them. The run took place in mid-October 2026. It cost $1,213,430 in API credits, or about $1,279 per exploit.
The company described the work on November 4 in a research post titled “A thousand fewer paths to root”. Its warning for Linux users is direct. A low-privileged account on an unpatched system “should be considered functionally equivalent to root access for a well-resourced threat actor,” OpenAI writes.
What OpenAI built and what it found
The system is a five-stage pipeline built around an upcoming cyber model that OpenAI has not named. AI agents choose parts of the kernel to audit and scan them for bugs. Other agents reproduce each bug in an isolated virtual machine, test whether it can be exploited and write a patch. Human security researchers then review the exploit, the patch and the proposed severity before anything goes to maintainers.
Each local privilege escalation (LPE) exploit lets an unprivileged local user gain root access. The test machines ran a stock desktop operating system based on a commonly used Linux distribution. Standard kernel protections stayed on, including SMEP, SMAP, KASLR and HARDENED_USERCOPY. OpenAI stresses that this was not a weakened target.
The run also produced 291 proof-of-concept programs for information leak bugs. In a sample of 166 exploits, OpenAI found at least 10 exploitation techniques that were new to its team. Outside kernel exploitation experts it consulted had not seen them either. The company withheld the full details for safety reasons.
What changes for you
These are local flaws. An attacker first needs a way to run code on the machine, such as an ordinary user account or a compromised app. OpenAI’s argument is that once that foothold exists, an out-of-date kernel offers little resistance. That makes update speed the main defense for most people.
Desktop Linux users
Install kernel updates from your distribution as they arrive, and restart so the new kernel actually loads. OpenAI says the fast pace of disclosure and patching makes it critical for users and companies to keep software up to date.
Server admins and cloud teams
Shared machines face the most exposure. Any system that gives shell access to untrusted users or workloads fits the threat model OpenAI describes. The company recommends defense in depth and names isolation tools such as Firecracker and gVisor to limit the damage from an exploited flaw.
Developers and maintainers
OpenAI suggests rescanning code each time AI models improve, because a stronger model can find bugs an earlier one missed. It also recommends using models to review both human and AI-written patches for bypasses and missed variants. Before filing reports, findings should be checked again against the latest code to avoid duplicates.
How the latest run compares with earlier ones
This is OpenAI’s third published round of Linux kernel work in 2026. Each run used a newer model, and the results grew sharply.
| Run | Model | Root (LPE) exploits | API cost |
|---|---|---|---|
| June 2026 | GPT-5.5 Cyber | 24 | Not stated |
| Late July 2026 | GPT-5.6 Sol | 166 unique | $513,690 |
| Mid-October 2026 | Unnamed upcoming cyber model | 948 unique | $1,213,430 |
| Mid-October 2026 (adapted kernelCTF setup) | Same pipeline | 21 | About $32,936 |
Both the July and October scans targeted the latest kernel master branch at the time. Even so, the October run found more than five times as many new LPE flaws, despite three months of hardening between the two scans.
Where the fixes stand
Following advice from the Linux kernel community, OpenAI reported critical flaws first. It says it has already sent hundreds of reports and patches. The rest will go out gradually through partners in Patch the Planet, which is part of OpenAI’s Daybreak security effort.
Maintainers moved fast. When the scan and manual analysis ended after 10 days, 61 of the LPE flaws had been patched upstream. Another 43 had staging patches, and 299 were being reported and discussed publicly. The 948 figure counts distinct patches OpenAI developed, not fixes already merged into the kernel.
Inside the pipeline: the technical details
From 40 million lines to 948 flaws
- Scouting: Scout agents narrowed a kernel of more than 40 million lines to 5,034 audit targets. Those covered about 2.8 million lines, roughly 7% of the code, and cost $3,426.
- Analysis: Analyst agents produced 2,308 deduplicated candidate bugs in 12 hours, at a cost of $316,549.
- Validation: Triage agents reproduced 1,724 bugs, about 74.7%, within 30 hours in test machines running the Kernel Address Sanitizer (KASAN). This stage cost $73,330.
- Screening: A screening agent kept 313 information leak candidates and 1,238 LPE candidates, for $44,194.
- Exploitation: Exploit agents produced 1,169 working LPE exploits. Variant analysis then grouped them into 948 distinct flaws. This was the most expensive stage at $775,929.
Only 3.1% of the unconfirmed candidates came from wrong analysis by the model. Most others needed elevated privileges or hit hard-to-trigger conditions, such as race conditions. A successful exploit cost $359 on average. Failed attempts averaged $3,922 across 69 cases, and OpenAI says a simple give-up rule would have cut that cost.
Mistakes and surprises
In an early run, agents reported 200 successful exploits. Human review showed that 20 reached root through a different zero-day bug than the one assigned. OpenAI added an independent check that each exploit uses its assigned flaw.
During the kernelCTF run, the system also found and exploited a bug in QEMU TCG, part of the test setup itself. That bug was already fixed upstream but not in the release build OpenAI used. The company says it has also disclosed and patched flaws in Kata, Moby/Docker, gVisor and other projects.
Patch quality needed work too. Early AI patches blocked the test exploit but sometimes added extra code, hurt performance, broke coding style or missed related variants. More instructions and iteration improved them. In a few cases, the system caught issues in patches written by human experts before those patches were merged.
Stronger models need less hand-holding
GPT-5.5 Cyber struggled to apply known kernel exploitation techniques on its own. Giving it a library of 103 techniques raised its success rate from 76.2% to 88.9% across 63 candidates. GPT-5.6 Cyber beat that result without the library. Adding the library back gave it only 1.5 more percentage points.
The bounty math
OpenAI compares its costs with public bug bounties. Pwn2Own and TyphoonPWN historically paid $20,000 and $70,000 for a Linux kernel LPE exploit. Applied to 948 exploits, that suggests a hypothetical value of $18.9 million to $66.3 million, about 16 to 55 times the run’s cost.
Google’s kernelCTF reward program uses a hardened kernel with a smaller attack surface. On an adapted version of that setup, the pipeline produced 21 LPE exploits and 25 information leak proofs of concept in 112 hours. OpenAI dropped the SLAB_VIRTUAL protection because it did not work with the latest kernel. For comparison, kernelCTF had accepted 26 confirmed zero-day LPE exploits in 2026 at the time of writing. If all 21 were accepted, OpenAI estimates a payout of around $1.5 million.
OpenAI concludes that its pipeline was “net profitable” based on public payout levels. That cuts both ways. RuntimeWire’s analysis of the report notes that the same capability could shorten the time from a kernel commit to a working root exploit. It argues this makes human review and maintainer-controlled patching important safeguards.
What remains unclear
- The model: OpenAI has not named the cyber model behind the October run or said when it will ship.
- The flaws: The post does not list CVE numbers, affected subsystems or the exact distribution tested.
- Other devices: OpenAI notes that the kernel underpins Android and cloud systems. However, it does not say whether any of these flaws reach Android builds.
- The costs: OpenAI calls its figures an upper bound, since better engineering could lower them. Real attacker costs may differ.
- The backlog: Most of the 948 flaws were still in the reporting pipeline when OpenAI published its results.
OpenAI says it will extend this work to more critical software through Patch the Planet. Until those fixes land, the practical advice is simple: keep Linux systems updated and limit who can run code on them.
