OpenAI's AI churns out 948 Linux root exploits for $1.2 million

What's going on

On November 4, 2026, OpenAI's cyber team published a detailed research report titled "A thousand fewer paths to root." Root is the administrator account on Linux, the one that can do anything on a machine. The team built a largely automated pipeline: a chain of AI agents that work one after another. The chain hunts for security bugs in the Linux kernel, verifies them on isolated test machines, writes working attack programs (exploits) and finally proposes a patch, meaning a fix to the code.

At its core is an unreleased cyber model from OpenAI. In mid-October 2026, the system ran against the kernel's development tree as it stood at the time. The result: 948 distinct local privilege escalation (LPE) bugs. With a bug like this, someone who only has a normal user account on a machine can gain root. API costs for the whole run came to $1,213,430. That works out to roughly $1,279 per bug.

The work is part of OpenAI's "Patch the Planet" initiative, which sits within the broader "Daybreak" program aimed at securing open-source projects. Back in June, OpenAI reported that GPT-5.5 Cyber had built 24 such kernel exploits.

How the pipeline works, step by step

The kernel has more than 40 million lines of code, and not all of it matters for security. So the pipeline runs in five stages:

1. Scout agents go through every directory and file. They pick out areas that an ordinary user can reach and that matter for security. That produced 5034 audit targets covering about 2.8 million lines, roughly 7 percent of the kernel.
2. Analyst agents read that code, work out how an attacker might go after it and flag suspected bugs. After 12 hours there were 2308 candidates, with duplicates already removed.
3. Triage agents try to actually trigger each candidate in a virtual machine running KASAN, a debugging tool that exposes memory errors in the kernel. After 30 hours, 1724 bugs had been reproduced, or 74.7 percent.
4. ExploitDev agents check whether a real attack can be built from each one. The test machines had the usual protections of a standard distribution switched on, such as KASLR (which randomizes where the kernel sits in memory so attackers don't know where anything is) and SMEP and SMAP (barriers that stop the kernel from accidentally using code or data from user space).
5. Human security researchers review the exploit, the patch and the severity before anything goes to the maintainers.

For each bug, the system delivers a four-part package: a root-cause analysis, a minimal program that triggers the crash, a proposed patch and the full exploit.

The numbers in detail

When reproduction failed, it was usually for one of three reasons: the bug needed higher privileges, it depended on hard-to-hit race conditions (bugs that only show up when events line up badly in time), or the check simply took too long. Only 3.1 percent of reports came from a faulty analysis by the model. A successful exploit cost $359 on average. Failed attempts were far more expensive, averaging $3,922. OpenAI says a cutoff rule like "stop after an hour without progress" would have saved a lot of money. It adds that the costs should be read as an upper bound anyway, since the team didn't optimize for efficiency.

For comparison, an earlier run: in late July, GPT-5.6 Sol found and exploited 166 unique bugs for $513,690. So in October the new model found more than five times as many new bugs, even though the kernel had been hardened for another three months in between.

What these exploits would fetch on the market

OpenAI also converts the results into bounty money. The hacking competitions Pwn2Own and TyphoonPWN used to pay $20,000 and $70,000 respectively for this kind of Linux exploit. Scaled up to 948 exploits, that would come to $18.9 million to $66.3 million on paper, or 16 to 55 times the cost. The pipeline was also run against a modified environment based on Google's kernelCTF bounty program, where the kernel is more heavily hardened and offers less attack surface. In 112 hours and for around $32,936, it produced 21 LPE exploits and 25 data-leak proofs. For context: kernelCTF had accepted 26 confirmed zero-day exploits in all of 2026 up to that point. If all 21 were accepted, OpenAI says they'd be worth around $1.5 million in bounties. The report's sober conclusion: at the time of the research, a pipeline like this was "net profitable." The same goes for attackers, though.

Surprises and lessons learned

• New attack techniques: In a sample of 166 exploits, OpenAI found ten techniques that are new as far as it knows. Outside kernel experts hadn't seen them either. OpenAI is withholding the details for security reasons.
• Agents taking shortcuts: In an early run, the system reported 200 successful exploits. But 20 of them had reached root through a different zero-day than the one they'd been assigned. Since then, OpenAI also checks which path an exploit actually took.
• Less scaffolding for stronger models: For GPT-5.5 Cyber, the team had compiled 103 known exploit techniques. That raised the success rate from 76.2 to 88.9 percent. GPT-5.6 Cyber did better even without that help; the technique library only added 1.5 percentage points.
• A hole in the test environment: In the kernelCTF environment, one agent stumbled on a bug in the QEMU TCG emulator and exploited it without access to QEMU's source code. The bug had already been fixed upstream, but not in the version being used. OpenAI says it has also reported and fixed bugs in Kata, Docker/Moby and gVisor.
• Patches: The first AI-written patches worked, but some were too long, broke coding conventions or missed related variants of the bug. Better instructions improved them. In some cases the system even found bugs in patches written by humans.

Where the fixes stand

Following advice from the kernel community, OpenAI reported the critical bugs first: hundreds of reports with patches have gone out. The rest will follow gradually, together with partners. During the ten days the scan and analysis took, OpenAI saw a fast response: 61 bugs had already been fixed upstream, 43 had patches in the works and 299 were being discussed publicly. Industry site Cryptobriefing points to the flip side: 104 fixes, done or in progress, against 948 working exploits. That leaves a big backlog. Blockchain.news notes critically that it's unclear how many of the AI patches maintainers will actually accept, and how quickly they'll reach widely used distributions.

OpenAI itself issues a stark warning:

"In the short to medium term, access to a low-privilege account on an operating system that isn't fully patched should be considered functionally equivalent to root access for a well-resourced attacker."

It recommends extra layers of protection such as sandboxes and isolation tools like Firecracker and gVisor.

Our take

The report shows vividly how security research is changing. Every single kernel exploit used to mean weeks of specialist work. Now almost a thousand come out of an industrial process, for less money than a single competition prize would pay. For defenders that's an opportunity, and for admins the message is clear: install updates right away, and add extra isolation for containers and multi-user systems. What OpenAI can do with an unreleased model, other models will likely be able to do before long. OpenAI itself expects that within a few years, frontier models will find practically every existing bug.

Some caveats remain. All the numbers come from OpenAI and haven't been independently verified. The bounty math is hypothetical. The model isn't public, and the new techniques are under wraps. It's also unclear how much the flood of reports will strain the kernel community, which relies heavily on volunteers. Bottom line: it's a powerful demonstration for defenders, and a sign of how cheap attacks could soon become.