OpenAI Model Builds 948 Linux Root Exploits in One Run

OpenAI said on November 4, 2026 that an automated research pipeline built around an unreleased cyber model produced 948 distinct Linux kernel privilege escalation exploits in a single campaign run in mid-October, each one able to turn an ordinary local account into root. The company's Cyber team aimed the system at the newest kernel, with target virtual machines running an unmodified desktop build of a widely used distribution, and said the run consumed $1,213,430 worth of API credits, which works out to $1,279 for each exploit. The work, published under the title "A thousand fewer paths to root," also generated a candidate fix for every flaw, and OpenAI said hundreds of reports and patches had already gone to kernel maintainers.

The pipeline worked in stages. Scout agents first sorted the kernel's more than 40 million lines by whether a low-privileged user could reach the code and whether it mattered for security, which left 5,034 audit targets covering about 2.8 million lines, or roughly 7% of the code base. Analyst agents then reviewed those targets and, within 12 hours, returned 2,308 candidate findings after duplicates were removed. Triage agents wrote a proof of concept for each candidate and ran it in isolated virtual machines instrumented with the Kernel Address Sanitizer. Over the next 30 hours they confirmed 1,724 of them, close to three quarters. OpenAI said only 3.1% of the candidates rested on faulty analysis. Most of the rest needed elevated privileges or involved race conditions and trigger states the agents could not reproduce in the time allowed.

Screening narrowed the confirmed bugs to 313 possible information leaks and 1,238 possible privilege escalations. Exploit-development agents then attacked those candidates on machines with standard distribution defenses switched on, including SMEP, SMAP, KASLR and HARDENED_USERCOPY, so no result depended on a weakened target. They delivered 291 information leak proofs of concept and 1,169 working root exploits, which variant analysis reduced to 948 unique vulnerabilities. A successful exploit cost about $359 in credits on average. Looking at a sample of 166 exploits, the researchers counted at least 10 exploitation techniques they believed had never been documented, and outside kernel exploitation specialists who reviewed them agreed. The details were withheld for safety reasons.

The model's output did not always mean what it claimed. In an earlier run, the exploitation stage reported 200 successful root exploits, but human reviewers found that 20 got root by way of some other zero-day instead of the bug the agent had been assigned. OpenAI responded by tightening task rules and adding a separate check that ties each exploit to its assigned bug. Security researchers still review every exploit, patch and severity rating before anything is sent upstream.

Model capability changed the results sharply. A July scan of the kernel's master branch using GPT-5.6 Sol had turned up and exploited 166 unique privilege escalation flaws for $513,690. The October run surfaced more than five times as many, even though three months of hardening had happened between the two. In June, under the Patch the Planet program it runs with Trail of Bits, OpenAI had reported 24 such exploits from GPT-5.5 Cyber. Run against an adapted copy of Google's kernelCTF, which uses a hardened, stripped-down kernel, the pipeline produced 21 root exploits plus 25 leak demonstrations over 112 hours for roughly $32,936. kernelCTF had accepted 26 confirmed zero-day exploits all year. Using historical Pwn2Own and TyphoonPWN payouts of $20,000 and $70,000, OpenAI valued the October haul at $18.9 million to $66.3 million and concluded the effort would have turned a profit at public bounty rates. During the kernelCTF run, the agents also found and exploited a QEMU TCG flaw in the test environment itself.

Kernel developers moved quickly. By the time the scan and manual review finished 10 days later, 61 of the escalation bugs had been fixed upstream, 43 more had patches in staging and 299 were under public discussion. The wider picture points the same way. Google Threat Intelligence Group figures cited by The Hacker News showed monthly vulnerability disclosures more than doubling this year, to 10,740 in August 2026 against 5,045 in January, and the U.K. National Cyber Security Centre said in a November 3 assessment that AI tools have almost certainly driven a significant rise in zero-day discovery and that organizations will need to adapt how they patch and test.

The research underscores that the gap between disclosure and a working exploit is shrinking toward zero for Linux, and that OpenAI now treats any low-privileged account on a system missing its latest patches as effectively equal to root for a capable attacker. Auditors and risk teams at banks and insurers should confirm that kernel updates for Linux servers, container hosts, appliances and Android fleets carry their own patch SLAs measured from the upstream fix date, and that the asset inventory records the kernel version on each system. Risk models that assume weeks between disclosure and exploitation deserve a fresh look, as do controls that treat local access as low risk, including shared jump hosts and CI runners. Third-party reviews should ask vendors of Linux-based products how fast they ship kernel fixes, and architecture reviews should check for sandboxing and isolation such as gVisor or Firecracker around untrusted workloads.