OpenAI Agents Built 948 Linux Root Exploits

OpenAI said on Nov. 4 that an autonomous agent pipeline running an unreleased cybersecurity model produced working root exploits and candidate patches for 948 distinct local privilege-escalation bugs in the Linux kernel during a single run in mid-October. The company put the total API bill at $1,213,430, according to its report "A thousand fewer paths to root," as described by RuntimeWire and other outlets.

Key takeaways

• The pipeline flagged 2,308 candidate kernel flaws in 12 hours and reproduced 1,724 of them in 30 hours.
• It ended with 948 distinct local privilege-escalation (LPE) bugs, each with a working exploit and a candidate patch, at roughly $1,280 per bug in API costs.
• Ten days after the scan, 61 fixes had landed upstream, 43 more were staged and 299 were being reported or discussed publicly.

How OpenAI's Linux kernel pipeline works

The system chains several groups of AI agents. "Scout" agents first narrowed the kernel to 5,034 audit targets covering about 2.8 million lines of code. "Analyst" agents then hunted for bugs, and "Triage" agents tried to trigger each one inside virtual machines.

The test machines ran a stock desktop configuration with standard defenses such as SMEP, SMAP and KASLR enabled, according to the report summaries. Surviving bugs went through an exploitability check, exploit writing and patch generation. Variant analysis grouped related exploits, so each of the 948 bugs is counted by the distinct patch that closes it.

Cost of 948 Linux root exploits

At $1,213,430 in total, the run cost about $1,280 per distinct bug. OpenAI compared that with past contest payouts: Pwn2Own and TyphoonPWN have offered $20,000 and $70,000 per Linux kernel LPE, which would value 948 bugs at $18.9 million to $66.3 million. Those figures are a hypothetical benchmark, not money OpenAI earned.

The jump in scale is steep. A July run using GPT-5.6 Sol found 166 unique LPEs, according to the report as summarized by the DEV Community post and The Neuron newsletter.

Disclosure and limits

Every finding passes human review before it is reported. "We're working with Linux maintainers and Patch the Planet partners on reports and patches," OpenAI said in a post on X. Reporting started with the most critical bugs, following Linux kernel community guidance.

The results have clear limits. Each LPE requires an attacker who already has low-privilege access to the machine, so none is a remote break-in on its own. Most of the 948 candidate patches had not been merged as of the report, and OpenAI did not name the model it used.

Context

AI labs are racing to turn bug-finding models into defensive tools, while attackers adopt the same techniques. We have covered how attackers ran agents that rebuilt their malware until scanners stopped catching it. A flood of AI-found kernel bugs also puts new pressure on volunteer maintainers who must review each fix.

What's next

OpenAI said it is working through the remaining findings with partners. The key numbers to watch are how many of the 948 patches land upstream and how quickly Linux distributions ship them to users.

FAQ

Can these Linux bugs be exploited remotely?

Not on their own. They are local privilege-escalation bugs, meaning an attacker must already run code on the machine as an ordinary user to gain root.

Are all 948 bugs fixed?

No. About 10 days after the scan, 61 fixes were upstream and 43 were staged. The rest were still being reported or reviewed.

Which AI model did OpenAI use?

OpenAI described it only as an upcoming cybersecurity model. An earlier July run used GPT-5.6 Sol.

References

• OpenAI says its agents exploited and patched 948 Linux kernel flaws for $1.2M — RuntimeWire (Nov. 4, 2026)
• 948 Linux Root Exploits in One Run: What OpenAI's Kernel Pipeline Actually Proves — and What It Doesn't — DEV Community (Nov. 5, 2026)
• Everything That Happened in AI Today Thursday, November 5 — The Neuron (Nov. 5, 2026)