OpenAI's unreleased AI found 948 Linux root flaws in one $1.2M run

OpenAI says an autonomous pipeline running an unreleased cyber model found and exploited 948 distinct Linux kernel flaws that let an ordinary user take full “root” control of a machine, all in a single run that cost more than $1.2 million in API credits. The run reproduced 1,724 real vulnerabilities and generated candidate patches alongside the exploits, which OpenAI says it is now sharing with Linux maintainers and partners in its Patch the Planet program.

The company disclosed the results in a post on X and on its security research blog, in a post titled “A thousand fewer paths to root”. In its X post, OpenAI said:

“Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.”

OpenAI frames the goal as helping defenders find and fix vulnerabilities before attackers can use them. Every number in this article comes from OpenAI’s own accounting as reported by news outlets. No independent audit of the run has been published.

How OpenAI’s pipeline went from kernel code to root exploits

The Linux kernel is the core of the Linux operating system and sits underneath Android devices, cloud infrastructure and supercomputers. OpenAI says billions of people use Linux-based devices and that the project has more than 40 million lines of code. The run took place in mid-October, according to OpenAI.

The pipeline splits the work across specialised AI agents, software that plans and carries out multi-step tasks on its own. As OpenAI describes it, the stages ran in this order:

1. Scouting. “Scout agents” picked out 5,034 security-relevant targets covering about 2.8 million lines of kernel code, roughly 7% of the codebase.
2. Analysis. Analyst agents examined those targets and produced 2,308 candidate findings within 12 hours.
3. Reproduction. The system tried to reproduce each issue inside isolated virtual machines cut off from the internet and confirmed 1,724 vulnerabilities within 30 hours.
4. Screening. A screening agent narrowed those to 1,238 local privilege escalation candidates and 313 information-leak candidates. Local privilege escalation means a user already logged into a machine gains root, the highest level of control.
5. Exploit development. Exploit agents tested the flaws with standard security protections switched on. They produced proofs of concept for 291 information leaks and 1,169 working local privilege escalation exploits.
6. De-duplication. The 1,169 exploits mapped to 948 distinct patches, which OpenAI uses as its count of unique privilege escalation vulnerabilities.

The last step matters for reading the headline figure. Several exploits can target the same underlying flaw, so OpenAI counts patches rather than exploits. Coverage has described the result in slightly different ways: India Today writes that the model identified 948 vulnerabilities and built exploits for them, and Startup Fortune describes 948 working exploits “each with a patch already attached”. OpenAI’s own breakdown, as reported, is 1,169 exploits resolving to 948 distinct fixes.

Human security researchers reviewed the results before reporting vulnerabilities and proposing fixes to Linux maintainers.

What OpenAI’s run adds over earlier AI bug hunting

OpenAI says the agents also discovered and used at least 10 Linux exploitation techniques that its researchers and outside experts it consulted considered novel. The company argues this suggests frontier large language models can discover new approaches to exploitation rather than only apply known techniques.

Startup Fortune places the run in a longer line of OpenAI cyber work:

• In May 2025, independent researcher Sean Heelan used OpenAI’s o3 model, with no tool access, to find CVE-2025-37899, a remote zero-day in the kernel’s SMB file-sharing code.
• In October 2025, OpenAI launched Aardvark, an autonomous vulnerability-hunting agent that the outlet says found 92% of known and seeded vulnerabilities in testing and earned 10 CVEs (public vulnerability identifiers) through responsible disclosure.
• In June 2026, OpenAI launched Patch the Planet, a Daybreak initiative built with Trail of Bits, HackerOne and Calif that pairs a cyber-specialised model with human security engineers who review every finding before it reaches a maintainer.

At Patch the Planet’s launch, the same approach applied to the Linux kernel produced 8 pointer-leak proofs of concept and 24 local privilege escalation proofs of concept, according to Startup Fortune. India Today reports that OpenAI said the October campaign substantially exceeded an earlier run.

Startup Fortune also argues that human researchers and fuzzing tools (automated programs that throw malformed inputs at software) typically surface “low hundreds” of serious kernel flaws per year, and that OpenAI’s run produced roughly double that privilege-escalation count in one sitting. That comparison is the outlet’s own estimate, not a figure from OpenAI.

OpenAI’s cost claims, and what they measure

OpenAI puts the full campaign at $1,213,430 in API credits. Startup Fortune works this out to roughly $1,265 per vulnerability.

To give that figure context, OpenAI compared it with historical Linux kernel bug bounty rates: $20,000 at the Pwn2Own hacking contest and $70,000 at TyphoonPWN. Applied to 948 vulnerabilities, those rates give a hypothetical value of $18.9 million to $66.3 million, or about 16 to 55 times the pipeline’s cost.

OpenAI ran a second, smaller test on an adapted version of kernelCTF, Google’s kernel exploitation challenge, with a reduced attack surface.

Measure	Main Linux run	Adapted kernelCTF run
API cost (per OpenAI)	$1,213,430	About $32,936
Information-leak proofs of concept	291	25
Privilege escalation exploits	1,169 (948 distinct flaws)	21
OpenAI’s illustrative bounty value	$18.9M to $66.3M	About $1.5M
Multiple of cost	About 16x to 55x	About 45x

For scale, OpenAI noted that kernelCTF had accepted only 26 confirmed zero-day privilege escalation exploits in all of 2026 so far. The bounty figures are an illustrative valuation, not actual bounty income. None of the 21 kernelCTF results had been accepted by the program, according to the coverage, and market bounty rates also reflect scarcity, which would change if exploits became cheap to produce.

Access: an unreleased model with no date

There is nothing to call yet. OpenAI has given no details of the model behind the pipeline, including any release date. The pipeline itself is described as a company-run experiment. Startup Fortune notes that OpenAI has been explicit that these are controlled internal runs, and that Trail of Bits engineers sign off before findings reach a maintainer. Neither source describes plans to offer the pipeline as a product.

On disclosure, OpenAI says it has sent hundreds of reports and patches for critical vulnerabilities in line with guidance from the Linux kernel community, and is working with maintainers and Patch the Planet partners to report and address more. The 948 figure describes validated exploits with candidate patches, not 948 fixes already shipped in the kernel. OpenAI is not publishing the exploit code.

Limits and risks OpenAI’s results raise

Automated checks can be wrong. OpenAI itself says independent checks remain necessary. In one early run, 20 of 200 apparently successful exploits had gained root through vulnerabilities other than the ones they were assigned. That is a 10% mismatch rate in that early run, and it shows why the human review layer and the de-duplication step exist.

The numbers are self-reported. The counts, timings, novelty judgements and costs all come from OpenAI. The “novel” label on the 10 techniques rests on OpenAI’s researchers and the experts it consulted. An outside replication or a tally of accepted kernel patches would be the stronger evidence.

Maintainer load. Hundreds of reports arriving at once is a different burden from a steady trickle. The sources do not say how kernel maintainers are triaging the volume or how many patches have been accepted so far.

Attackers have AI tools too. The same week’s security news shows the other side. CrowdStrike reported that a China-based state-sponsored group it tracks as Vapor Panda used an AI-powered penetration testing framework called ARTEX against more than 200 organisations worldwide starting October 17, 2026. CrowdStrike said such agentic tooling allows “a small team to pursue a wider target set than manual operations would support”. OpenAI’s argument is that defenders need to find the flaws first; the open question, as Startup Fortune puts it, is who gets to run pipelines like this.

This fits a broader pattern of labs testing what their agents can do on real systems. Unicorn API has covered Anthropic’s report that its models hacked three real companies on their own in tests and a UK agency’s finding that Anthropic and OpenAI agents faked identities in tests.

What OpenAI’s Linux run means for builders

For teams shipping software, the practical message is about patch cadence. If OpenAI’s figures hold, a large batch of Linux kernel fixes for local privilege escalation bugs is moving toward maintainers. Anyone running Linux servers, containers or GPU clusters where untrusted code or multiple users share a kernel should expect a steady flow of kernel updates and plan to apply them quickly. Local privilege escalation is the class of bug that turns a foothold, such as a compromised container or a low-privilege account, into full control of the host.

For security tooling startups, Startup Fortune argues the run sets a harder proof point for automated pentesting and AI code scanning products, and that roughly $1,265 per vulnerability makes automated auditing something companies may start budgeting for. Two caveats apply: the per-bug figure leaves out the human review time OpenAI says every finding received, and the model that produced it is not available. Builders working with OpenAI’s code tools can follow related moves, such as OpenAI’s planned purchase of Pierre, the startup behind Codex’s code review tools, and the security industry’s push into agent controls, including CrowdStrike’s deals for Fiddler AI and Dreadnode.

The pipeline design itself is a useful pattern even without OpenAI’s model: cheap broad scouting, analysis, reproduction in isolated machines, screening by impact, exploit attempts under real protections, then de-duplication by patch. OpenAI’s early-run mismatch shows why each stage needs its own verification rather than trusting the agent’s report of success.

What to watch next

• Kernel patches landing. How many of the 948 candidate fixes Linux maintainers accept, and how quickly, is the clearest outside test of OpenAI’s numbers.
• Independent review. Whether security researchers outside OpenAI and its partners confirm the 10 novel exploitation techniques once details are disclosed.
• The model itself. OpenAI has not named the cyber model or given a release date. Any launch will raise questions about who gets access and under what safeguards.
• Other codebases. Whether Patch the Planet runs the same pipeline against other widely used open-source projects beyond the kernel.