OpenAI says an AI system it built found and exploited Linux kernel security flaws at a scale no human team has managed. In a research post published on 4 November, the company said its automated pipeline, powered by an upcoming cyber model that has not been released, produced working exploits for 948 distinct local privilege escalation vulnerabilities, bugs that let an ordinary user on a machine take full control of it as "root".
The whole run, in mid-October 2026, cost $1,213,430 in API credits, or about $1,279 per exploit, according to OpenAI. The targets were virtual machines running a stock desktop Linux distribution with its standard protections switched on, not a weakened test system.
How the pipeline worked
OpenAI describes five stages. Scout agents picked 5,034 security-relevant parts of the Linux kernel, about 2.8 million lines or roughly 7% of the code. Analyst agents produced 2,308 candidate bugs within 12 hours. Triage agents then reproduced 1,724 of them, about 75%, in isolated machines over 30 hours. Exploit agents produced 291 working information-leak attacks and 1,169 working root exploits, which OpenAI grouped into 948 unique flaws. The system also wrote a candidate patch for each one, and human researchers reviewed the results before reporting them.
The company says the agents used at least 10 exploitation techniques that outside kernel experts had not seen before, and it is withholding their details for safety. It also says the newer model found more than five times as many new flaws as a July run with GPT-5.6 Sol, which found 166 for $513,690.
OpenAI flagged one failure: in an early run, 20 of 200 reported exploits had reached root through a different zero-day bug from the one they were assigned, so it added an independent check. SecurityOnline, which reported the figures on 5 November, notes they have not been independently verified.
Related · AI and Tech StakMeta and OpenAI Buy AI Coding Startups on the Same DayMeta is taking Conductor, which runs teams of coding agents, and OpenAI is buying Pierre, whose Code Storage powers apps like Lovable and Bolt.Patches are racing the attackers
OpenAI says it has already sent hundreds of reports and patches for critical flaws to Linux maintainers and is releasing the rest gradually with partners in its Patch the Planet programme. When its scan finished, 61 of the flaws had been patched upstream, 43 had patches in staging and 299 were being discussed in public.
The company's warning is blunt: for now, a low-privileged account on a system that is not fully up to date "should be considered functionally equivalent to root access" for a well-resourced attacker. It recommends isolation tools such as gVisor and Firecracker to limit the damage when a flaw is used.
Applying past bounties from the Pwn2Own and TyphoonPWN hacking contests, $20,000 to $70,000 per Linux root exploit, OpenAI values the haul at $18.9 million to $66.3 million, 16 to 55 times what the run cost. That arithmetic cuts both ways: what is cheap for defenders is also getting cheap for attackers.
