Key Takeaways
- OpenAI said on November 4, 2026, that its AI vulnerability research pipeline, running an upcoming cyber model in mid-October, built working exploits for 948 unique local privilege escalation flaws in the Linux kernel at a cost of $1,213,430 in API credits.
- OpenAI's Linux kernel run produced 2,308 candidate findings, reproduced 1,724 vulnerabilities, and yielded 1,169 working privilege escalation exploits and 291 information leak proofs of concept, according to the company.
- When OpenAI's 10-day Linux kernel scan and manual analysis ended, 61 of the privilege escalation flaws had been patched upstream, 43 had staging patches, and 299 were being reported and discussed publicly, OpenAI said.
- OpenAI said that for the near and medium term, a low-privileged account on an operating system that is not up to date on its patches should be considered functionally equivalent to root access for a well-resourced attacker.
What OpenAI announced
OpenAI said on November 4, 2026, that it had built an automated pipeline of AI agents that finds, validates, exploits, and patches security flaws, and had run it against the Linux kernel, the core of the Linux operating system. In a research report titled "A thousand fewer paths to root," the company said one run in mid-October 2026 produced working exploits for 948 local privilege escalation flaws.
A local privilege escalation flaw lets someone who already has an ordinary account on a computer gain root access, the highest level of control. OpenAI said the flaws it found "could allow an unprivileged local user to gain root access."
The pipeline ran on an unreleased OpenAI cyber model, SecurityWeek reported. The work extends Patch the Planet, an OpenAI initiative under which the company said in June that its GPT-5.5 Cyber model had found Linux kernel flaws and built 24 privilege escalation exploits. Human security researchers reviewed each exploit, patch, and proposed severity before anything was reported to the kernel's maintainers, OpenAI said.
The run cost $1,213,430 in application programming interface (API) credits, or $1,279 per exploit, according to OpenAI.
What the agents found
OpenAI said its agents first picked out the parts of the kernel that low-privileged users can reach, about 7% of the kernel's code, and then produced 2,308 candidate findings. Within 30 hours the system reproduced 1,724 of them as real vulnerabilities in isolated test machines, the company said.
The agents then built 1,169 working privilege escalation exploits and 291 proofs of concept for information leaks, according to OpenAI. The company counted 948 unique flaws based on the number of distinct patches it wrote for the bugs behind those exploits. The exploits were tested on a stock desktop operating system with standard kernel protections turned on, not a weakened target, OpenAI said.
The October run found more than five times as many new privilege escalation flaws as a July run with OpenAI's GPT-5.6 Sol model, which found 166, even though the kernel had three months of hardening in between, the company said. OpenAI said the agents used at least 10 exploitation techniques that outside kernel experts had not seen before. It withheld the technical details of those techniques for safety reasons.
Against kernelCTF, Google's reward program built on a hardened version of the kernel, the pipeline produced 21 privilege escalation exploits for about $32,936 in API credits, OpenAI said.
OpenAI compared its costs with the $20,000 and $70,000 that the Pwn2Own and TyphoonPwn hacking competitions have paid for Linux kernel privilege escalation exploits, and put the hypothetical value of the 948 exploits at $18.9 million to $66.3 million. CSO Online noted that the comparison does not represent actual bounty payouts or establish that every finding would qualify for those rewards.
Patch status and open questions
Following guidance from the Linux kernel community, OpenAI said it began with critical flaws, has already sent hundreds of reports and patches to maintainers, and is working with Patch the Planet partners to send patches for the rest in stages. When the scan and manual analysis ended after 10 days, 61 of the flaws had been patched upstream, 43 had staging patches, and 299 were being reported and discussed publicly, the company said.
The report did not give a complete breakdown of the fix status of all 948 flaws, CSO Online reported.
OpenAI also reported an error in its own results. In an early run, 20 of 200 exploits the system marked as successful had gained root through a different, previously unknown flaw than the one assigned, and the company added an independent check afterward.
Sakshi Grover, a research director at IDC, told CSO Online that "the risk is less the 948 than the length of the window between discovery and fixes reaching production." She said a fix in the upstream kernel does not necessarily mean it has reached the kernel a Linux distribution runs in a business. Thomas Di Giacomo, chief technology and product officer at SUSE, told CSO Online that SUSE is using similar AI tools to find and fix flaws while working with upstream communities on disclosure and patching.
What Linux users should do
OpenAI said that "for the near and medium term, having access to a low-privileged account on an operating system, that isn't up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor." It said the fast pace of fixes makes keeping software up to date critical for users and companies.
OpenAI also recommended defense in depth, using sandboxes and isolation tools such as Firecracker and gVisor to limit the damage when a flaw is exploited.
Grover advised organizations to patch some systems first, CSO Online reported. Her list was multi-tenant hosts, which run workloads for several customers, continuous integration and delivery (CI/CD) runners that build and test code, shared bastion servers that administrators log in through, container platforms, and developer machines. She also advised asking Linux distributors when they will backport the fixes to the kernels they ship.