OpenAI says AI agents built root exploits for 948 Linux kernel flaws

OpenAI said Thursday that an automated pipeline driven by an unreleased cyber model generated working local privilege escalation exploits for 948 separate Linux kernel vulnerabilities during one mid-October run. The company put API credit costs at $1,213,430, about $1,279 per flaw.

OpenAI explained that the pipeline first reduced the kernel to security-relevant code reachable by low-privileged accounts, leaving roughly 7 percent of the code base, 5,034 targets and about 2.8 million lines. Analyst agents flagged 2,308 candidate bugs, and triage agents reproduced 1,724 of them within 30 hours. The scan targeted the latest code on the kernel's master branch.

Exploit-development agents tested the reproduced bugs on virtual machines running a standard desktop Linux configuration with protections including KASLR, SMEP and SMAP switched on. The run yielded 1,169 working LPE exploits and 291 information-leak proofs of concept. After merging exploits that shared the same root flaw, OpenAI counted 948 distinct vulnerabilities.

OpenAI said security researchers reviewed each exploit, patch and severity suggestion before anything was sent to kernel maintainers. In a sample of 166 exploits, at least 10 exploitation techniques were new to OpenAI and outside kernel-exploitation experts; technical details were withheld for safety.

The October run was larger than a late-July scan with GPT-5.6 Sol, which produced 166 unique LPE exploits for $513,690. OpenAI noted that the October run produced more than five times as many new local privilege escalation exploits even though the kernel had received three months of hardening between the two scans.

OpenAI compared the findings to historical Linux kernel privilege escalation payouts of $20,000 at Pwn2Own and $70,000 at TyphoonPWN. At those rates, the October exploits would hypothetically be worth $18.9 million to $66.3 million, or 16 to 55 times the run's cost. Against an adapted version of Google's kernelCTF, the pipeline generated 21 LPE exploits and 25 information-leak proofs of concept in 112 hours for about $32,936 in API credits. OpenAI said kernelCTF had accepted 26 verified zero-day LPE exploits in 2026 and estimated the 21 would have been worth around $1.5 million if the program took them.

OpenAI said it has submitted hundreds of reports and patches for critical vulnerabilities so far and will provide fixes for the rest in phases as part of its Patch the Planet initiative. SecurityWeek reported that during the scan's 10-day run, more than 100 of the flaws were already patched or had patches staged upstream. Help Net Security reported that by the time the scan and manual analysis ended after 10 days, maintainers had patched 61 of the privilege escalation bugs upstream, had staging patches for 43 more, and about 300 further bugs were being reported or discussed publicly.

The company warned that in the near and medium term, an attacker with a low-privilege account on an operating system missing recent patches "should be considered functionally equivalent to root access for a well-resourced threat actor". It advised defenders to use layered defenses, sandboxing and isolation tools such as Firecracker and gVisor to limit damage.

Update, November 6, 2026

BleepingComputer reported Friday that OpenAI has named the model behind the Linux kernel work GPT-6 Cyber. The company said the new model also discovered 81 high-severity Firefox flaws that had not been known before, and that Mozilla has already shipped many of the resulting patches.

In benchmark tests, GPT-6 Cyber exploited 48.5% of the vulnerabilities in ExploitGym, while the earlier GPT-5.6 Cyber managed 32.1%, according to BleepingComputer.

OpenAI classified GPT-6 Cyber's cybersecurity capabilities as "Critical" under its Preparedness Framework. That is one level above the previous model's "High" rating, the outlet reported.

The model is not yet public. Access is limited to selected customers in OpenAI's Daybreak Red program, with plans to open it to all Daybreak Red customers soon.