OpenAI says its AI pipeline built 948 Linux root exploits in one $1.2m run

OpenAI said on 4 November that an autonomous research pipeline built around an upcoming, unnamed cyber model found and exploited local privilege escalation (LPE) flaws in the Linux kernel at scale. In a mid-October run the system produced 2,308 candidate findings, reproduced 1,724 vulnerabilities in isolated virtual machines and generated 948 working LPE exploits that could let an unprivileged local user gain root access, plus 291 information-leak proofs of concept. The run cost USD 1,213,430 in API credits, or about USD 1,279 per exploit, according to OpenAI.

The figures are OpenAI's own. The 948 count refers to distinct candidate patches, which the company uses as its count of unique flaws; human researchers review each exploit and patch before it goes to the kernel maintainers. By the end of the ten-day scan, 61 of the flaws had already been patched upstream, 43 had staging patches and 299 were being reported or discussed publicly. OpenAI says it has sent hundreds of reports and patches for critical flaws and is releasing the rest gradually with partners in its Patch the Planet initiative.

The company says the newer model found more than five times as many novel LPEs as a GPT-5.6 Sol run in July, which found 166 for about USD 514,000. It also says the agents used 10 new exploitation techniques in the exploits it sampled; it withheld their details for safety reasons. In one early run, human review found that 20 of 200 reported exploits had reached root through a different, previously unknown flaw, so OpenAI added an independent check on each exploit's path.

OpenAI compared the cost with bug bounties. At historical Pwn2Own and TyphoonPWN payouts of USD 20,000 and USD 70,000 per Linux LPE, the 948 exploits would be worth a hypothetical USD 18.9m to USD 66.3m. The company presents its costs as upper bounds. In its conclusions it says that, for the near and medium term, a low-privileged account on an operating system that lacks its latest patches should be treated as functionally equal to root access for a well-resourced attacker.