Glonce

OpenAI pipeline generates 948 Linux root exploits for $1.2M in API costs

securityThe Glonce editorsHacker News🔥87Glonce rating87Impact75Novelty75Relevance100Surprise70Players90Credibility80
OpenAI pipeline generates 948 Linux root exploits for $1.2M in API costs

OpenAI's Cyber team has published a report on a prototype autonomous pipeline that looks for security flaws in the Linux kernel inside a controlled research environment. The pipeline is powered by an upcoming cyber model and covers vulnerability discovery, dynamic validation, exploitability assessment and patch generation. It builds on work OpenAI described in June under its Patch the Planet initiative, when GPT-5.5 Cyber identified Linux kernel vulnerabilities and developed 24 local privilege escalation (LPE) exploits to validate and report them.

The headline result comes from a run in mid-October 2026. The pipeline identified and analyzed 2,308 candidate kernel findings, dynamically reproduced 1,724 of them, generated proof-of-concept code for 291 information leak vulnerabilities, and produced 948 working LPE exploits, each of which could let an unprivileged local user gain root. The exploits target a commonly used Linux distribution. The target virtual machines ran a stock desktop operating system, not a weakened target, under the same threat model used by competitions such as Pwn2Own and TyphoonPWN. The whole run cost $1,213,430 in API credits, or $1,279 per LPE exploit.

The pipeline has five stages. Scout agents read through the kernel's folders and files and pick audit targets by reachability (reachable by low-privileged users) and security relevance. They identified 5,034 targets, about 2.8 million lines of code and roughly 7% of the kernel, for $3,426. Analyst agents, using a workflow similar to the Codex Security plugin, read each target, work out its threat model and look for bugs. Within 12 hours they produced 2,308 candidate findings after deduplication, at a cost of $316,549. Because a candidate is not a validated vulnerability and manual review at that scale is impractical, OpenAI validated only findings that were reachable by a low-privileged user, needed no special capabilities and produced measurable evidence of memory corruption. A triage agent wrote a proof of concept for each, ran it in an isolated virtual machine with a KASAN-enabled kernel, watched program output and the system console, and refined the proof of concept until it reproduced the behavior or ran out of ways to trigger it. Within 30 hours the system reproduced 1,724 vulnerabilities, about 74.7% of the candidates. The validation stage cost $73,330 in total. Agents then tested exploitability, generated patches, and security researchers reviewed the exploit, patch and proposed severity before anything went to maintainers. Each result is bundled as a root cause analysis, a minimal crashing proof of concept, a candidate patch and a full exploit.

Of the findings that did not reproduce, most either needed elevated privileges or failed within the time budget because of difficult race conditions, specific trigger conditions (such as a required allocation failure at a specific line) or slow validation (such as refcount wraparound). Only 3.1% reflected incorrect analysis by the model, where the reported bug assumed an impossible condition. OpenAI notes that validating a true positive and a false positive cost about the same, so removing false positives earlier in the pipeline matters.

OpenAI also ran the pipeline on an adapted kernelCTF environment, a Linux kernel version with reduced attack surface. It obtained 25 information leak proofs of concept and 21 LPE exploits for roughly $32,936 in API credits. For comparison, 26 confirmed 0-day LPE exploits had been accepted by kernelCTF in 2026 at the time of writing. OpenAI says that if the 21 vulnerabilities were accepted, they would lead to around a $1.5M bounty award, about 45 times the scanning cost. Applying historical Pwn2Own ($20,000) and TyphoonPWN ($70,000) bounty amounts to the 948 exploits gives a hypothetical valuation of $18.9M to $66.3M, approximately 16x to 55x the pipeline's cost. To the best of its knowledge, OpenAI says the agents discovered and used at least 10 novel Linux exploitation techniques.

On disclosure, OpenAI says it used the evidence to prioritize vulnerabilities for reporting and developed candidate patches for maintainer review. Following guidance from the Linux kernel community, it began with critical vulnerabilities and is working with Patch the Planet partners on further reports and patches. While the scan was running, over 100 Linux LPEs were patched, or had staging patches from other contributors, within 10 days, and about 300 more were being publicly discussed.

The report closes with OpenAI's reflections. A newer cyber model run in mid-October found more than 5x as many novel LPEs as a GPT-5.6 Sol run in July, despite three months of hardening between the scans. OpenAI believes automated patch generation is essential given the pace of discovery, and that with human expert-guided iteration AI-generated patches can be functionally correct, fit existing coding styles and resist attack variants, though it calls this an area for further research. It says large projects likely need multiple rounds of scanning and fixing, ideally repeated with each new generation of frontier models, for proprietary and open source software alike. For the near and medium term, a low-privileged account on an OS that is not up to date on patches should be treated as functionally equivalent to root access for a well-resourced threat actor, and sandboxes such as Firecracker and gVisor help limit the blast radius. Within a few years, OpenAI believes frontier models will likely be able to find vulnerabilities in a given project, and even less capable models may be able to develop exploits once vulnerabilities are disclosed. It points to secure-by-default code generation, smaller attack surface and formal verification as promising research directions.

Key facts

  • In a mid-October 2026 run, OpenAI's pipeline, powered by an upcoming cyber model, reproduced 1,724 of 2,308 candidate Linux kernel findings and produced 948 working local privilege escalation exploits for a commonly used Linux distribution.
  • The whole run cost $1,213,430 in API credits, or $1,279 per LPE exploit; OpenAI says these costs are more an upper bound because better harness engineering could cut them.
  • On an adapted kernelCTF environment the pipeline got 21 LPE exploits and 25 information leak PoCs for roughly $32,936, against 26 confirmed 0-day LPEs accepted by kernelCTF in 2026 so far.
  • Human researchers reviewed outputs before reporting vulnerabilities with candidate patches to maintainers; over 100 Linux LPEs were patched or had staging patches within 10 days while the scan ran.
  • OpenAI's advice: treat a low-privileged account on an unpatched OS as equivalent to root access for a well-resourced attacker, and invest in sandboxing, secure-by-default code and formal verification.

Why it matters

The report puts a price on bulk kernel exploitation: $1,279 per working root exploit in this run, with 948 produced in a single run. OpenAI says discovery is no longer the bottleneck; the hard part is working out which findings reproduce, what security boundary they cross and which deserve maintainers' attention first. It also reports a jump between model generations: the newer cyber model found more than 5x as many novel LPEs as a GPT-5.6 Sol run in July, even after three months of hardening. Earlier in June, GPT-5.5 Cyber had developed 24 LPE exploits, so the scale has moved from dozens to hundreds.

Who it affects

Linux kernel maintainers and distribution security teams, who may receive reports and patches at a volume they did not see before. Operators of Linux systems, including Android devices, cloud infrastructure and supercomputers, which the report says the kernel underpins. Security researchers and bounty programs such as Pwn2Own, TyphoonPWN and kernelCTF, against whose payouts OpenAI measures the output. Maintainers of other large codebases, since OpenAI says the same multi-round scan-and-fix process applies to proprietary and open source software.

How to use it

This is a research report, not a product; the pipeline and the upcoming cyber model are not released, and no release date is given. The practical advice is defensive. OpenAI says that, for the near and medium term, a low-privileged account on an operating system that is not up to date on available patches should be considered functionally equivalent to root access for a well-resourced threat actor. It recommends defense in depth, using sandboxes and isolation such as Firecracker and gVisor to limit the blast radius of exploited vulnerabilities. It publishes per-stage API costs so other researchers can assess the resources needed to reproduce and extend the work.

How solid is it

This is a first-party report from OpenAI's Cyber team, so the figures are self-reported. The key numbers (2,308 candidates, 1,724 reproduced, 948 exploits, $1,213,430) are stated consistently and each stage's reproduction rests on a KASAN-instrumented VM run by a triage agent. The 948 exploits were built against a stock desktop OS in virtual machines under competition-style rules, but only for one commonly used distribution, which the report does not name. The bounty valuations ($18.9M to $66.3M, and about $1.5M for kernelCTF) are hypothetical: they apply historical payouts to OpenAI's own results, and no bounty was claimed or paid. The claims about AI-generated patches are stated as belief and as an area for further research.

Risks and caveats

The upcoming cyber model is not named and no release date is given. The visible report text gives no count of how many of the 948 exploits or patches have been reported, accepted or merged upstream, and does not say how many patches were judged correct. The 'at least 10' novel exploitation techniques are not described. OpenAI itself says the costs are an upper bound and that it focused on methodology and capability rather than cost. Its own forecast is that frontier models will likely find vulnerabilities in a given project within a few years, and that even less capable models may be able to build exploits once flaws are disclosed, which shortens the window between disclosure and exploitation. Human review remained part of the process before anything was reported.

“should be considered functionally equivalent to root access for a well-resourced threat actor”

— OpenAI Cyber team, on a low-privileged account on an operating system that is not up to date on patches, in "A thousand fewer paths to root"