OpenAI’s pipeline wrote 948 root exploits for Linux

An OpenAI agent pipeline running on an upcoming cyber model produced 948 unique local privilege escalation exploits against the latest Linux kernel in mid-October, each one taking an unprivileged local user to root, OpenAI wrote in a November 4 post. When the 10-day scan and review ended, 61 of those flaws were already patched upstream, 43 had staging patches and 299 were being reported and discussed publicly. OpenAI’s advice from the run is that users and companies keep their software up to date, and the remaining patches are going out gradually.

Where the fixes are

OpenAI followed the Linux kernel community’s advice and sent the critical vulnerabilities first. Hundreds of reports and patches have gone out so far, and the rest are being released gradually with partners in Patch the Planet, a Daybreak initiative. Human researchers reviewed each exploit, its candidate patch and the proposed severity before anything reached maintainers. Each report included a root cause analysis, a minimal crashing proof of concept, the patch and a full exploit.

A fix that has landed upstream may still be missing from a distribution’s kernel. In October, a separate Linux root bug exploited by an Anthropic model had its fix upstream, yet Debian had shipped it on October 16 while Ubuntu and Red Hat still had no patch, per Golem, a status that may have changed since. OpenAI also says automated triage should recheck findings against the latest code, including code merged after the original scan, to avoid duplicate or obsolete reports.

What the 948 count

OpenAI counts unique exploits by distinct patches. Its exploit-development agents produced 1,169 working root exploits, and variant analysis (checking which exploits come from the same underlying flaw) brought these down to 948 distinct fixes. Validation kept only bugs that a low-privileged user could reach, that needed no special capabilities and that left measurable memory corruption. Reproduction ran in VMs with KASAN, the kernel’s memory-error detector, and confirmed 1,724 of 2,308 deduplicated candidate findings, about 74.7%. Only 3.1% of the candidates turned out to be wrong analysis by the model. Most of the others needed elevated privileges or ran out of time on hard race conditions. The exploits were tested against the protections a standard distribution turns on, including SMEP, SMAP, KASLR and HARDENED_USERCOPY.

Scout agents narrowed the audit to 5,034 targets reachable by low-privileged users. That came to about 2.8 million lines, roughly 7% of a kernel with more than 40 million.

Exploitation was the biggest part of the $1,213,430 bill: $775,929, with $691,000 of that spent on local privilege escalation candidates. Failed attempts were the expensive ones. OpenAI lists $3,922 for 69 unsuccessful cases against $360 for 1,169 successful ones, and blames a few hard-to-exploit vulnerabilities such as race conditions. A give-up rule, such as stopping after an hour with no progress, would have cut the exploit-development cost significantly, OpenAI says. It calls all its reported costs an upper bound, because the research focused on methodology and better harness engineering could lower them.

In late July, while the pipeline was still being built, GPT‑5.6 Sol found and exploited 166 unique LPE vulnerabilities for $513,690 end to end. Both runs targeted the Linux master branch as it stood at the time. In June, the first Patch the Planet results with GPT‑5.5 Cyber had included 24 such exploits.

How far the bounty math goes

OpenAI compares its costs with bug bounties. Pwn2Own and TyphoonPWN have historically paid $20,000 and $70,000 for a Linux kernel LPE. At those rates the 948 exploits would be worth a hypothetical $18.9 million to $66.3 million, about 16 to 55 times what the pipeline cost. The targets ran a stock desktop OS under the threat model those competitions use.

A separate run against Google’s kernelCTF, which uses a hardened kernel with less attack surface, took 112 hours and roughly $32,936. It produced 21 LPE exploits and 25 information-leak proofs of concept, while kernelCTF has accepted 26 confirmed 0-day LPE exploits in 2026 so far. The latest kernel would not work with kernelCTF’s SLAB_VIRTUAL mitigation, so OpenAI dropped it from the config for that run. If kernelCTF accepted all 21, OpenAI puts the payout at around $1.5 million, about 45 times the cost.

In a sample of 166 exploits, OpenAI counted 10 exploitation techniques that were new to it and to the outside kernel-exploitation experts it consulted. Five are data-only routes to privilege escalation. Two are new objects for spraying the kernel heap, two are page-grooming tricks that make exploits more reliable, and one involves arbitrary type confusion. OpenAI is withholding the details for safety reasons.

The pipeline marked a vulnerability as exploited when it obtained a root shell. In an early run it reported 200 successful exploits, and human review found that 20 of them reached root through a different 0-day from the one assigned. OpenAI then tightened the task constraints and added an independent check that each final exploit used its assigned vulnerability.

Lessons for other teams

OpenAI’s recommendations for teams doing similar work:

• Rescan code that has already been audited when models improve. A stronger model may find vulnerabilities an earlier one missed, even with the same harness.
• Verify how an agent reached its result as well as the result itself, with isolation, monitoring and independent checks.
• Re-evaluate scaffolding with each model generation. A library of 103 exploitation techniques raised GPT‑5.5 Cyber’s success rate from 76.2% to 88.9% across 63 candidates. GPT‑5.6 Cyber did better with light orchestration, and adding the library back gained it only 1.5 percentage points.
• Use models to review patches adversarially, whether humans or AI wrote them. First-pass generated patches sometimes fixed the proof of concept but added extra code, broke conventions or missed variants. In a few cases the prototype found problems in patches written by human experts, and these were fixed before merging.
• Test your research infrastructure before running offensive work on it.

The last lesson came from the kernelCTF run. An analyst agent studying system call entry code hit an unexpected crash and traced it to QEMU TCG without access to QEMU’s source. The exploit-development agent then turned the bug into a working root exploit. The bug had already been fixed in upstream QEMU, but the release build used in the experiment did not have the fix. OpenAI says it has tested its own infrastructure and disclosed and patched many vulnerabilities in Kata, Moby/Docker, gVisor and other projects.