948 ways to become root
OpenAI said on 4 November that an autonomous pipeline built around an unreleased cyber model found, validated and wrote patches for 948 local privilege escalation vulnerabilities in the Linux kernel during a single run in mid-October. A local privilege escalation flaw lets an ordinary user account take root. The run cost $1,213,430 in API credits, which the company puts at $1,279 per working exploit.
OpenAI describes five stages. Scout agents pick audit targets, analyst agents scan them, a triage agent tries to reproduce each candidate, further agents test exploitability and generate patches, and a human security researcher reviews the result before anything is reported to maintainers.
What the run produced
Scout agents selected 5,034 audit targets covering about 2.8 million lines of code, roughly 7% of a kernel OpenAI describes as more than 40 million lines. Analyst agents produced 2,308 candidate findings within 12 hours, at a cost of $316,549. Within another 30 hours the validation stage reproduced 1,724 of those candidates — about 74.7% — for $73,330. Only 3.1% of the rest reflected incorrect analysis by the model, according to OpenAI, with most of the remainder failing on difficult race conditions or time budgets.
From the validated set the pipeline produced proofs of concept for 291 information leak vulnerabilities and 948 working escalation exploits against what OpenAI calls a commonly used Linux distribution. The target machines ran a stock desktop operating system rather than a weakened build, under the threat model used by the Pwn2Own and TyphoonPWN competitions. Applying those contests’ historical kernel bounties of $20,000 and $70,000 to 948 exploits gives OpenAI a hypothetical valuation of $18.9m to $66.3m, or 16 to 55 times what the run cost.
The cheaper comparison
On an adapted version of kernelCTF, a kernel build with reduced attack surface, the same pipeline produced 25 information leak proofs and 21 escalation exploits for roughly $32,936. For context, OpenAI notes that kernelCTF has accepted 26 confirmed zero-day escalation exploits in 2026 so far. If the programme accepted all 21, the company estimates around $1.5m in bounties, about 45 times the scanning cost.
Every one of these figures is OpenAI’s own, reported about its own model and its own pipeline. None has been independently reproduced.
A moving baseline
The company says the October run found more than five times as many novel escalation flaws as a GPT‑5.6 Sol run in July, despite three months of hardening in between. In June, as part of its Patch the Planet initiative, OpenAI reported that GPT‑5.5 Cyber had produced 24 escalation exploits in the kernel. The new pipeline is credited with at least 10 novel exploitation techniques.
The maintainers were busy too
During the ten days the scan was running, OpenAI said, more than 100 Linux escalation flaws were patched or had staging patches from other contributors, with around 300 more under public discussion. That is the context the company uses to argue that automated patch generation, and not discovery, is now the operational bottleneck.
Its blunter conclusion is addressed to anyone running a shared machine: for the near and medium term, a low-privileged account on a system that is not current on patches should be treated as functionally equivalent to root access for a well-resourced attacker. OpenAI recommends sandboxing and isolation layers such as Firecracker and gVisor to limit the blast radius.
What to watch
Which of the 948 reach maintainers, and in what state. OpenAI says it began with critical vulnerabilities, following guidance from the kernel community, and is working with Patch the Planet partners on further reports and patches. The kernel’s own advisory stream will show how much of this converts into shipped fixes.
