OpenAI's AI finds 948 root bugs in the Linux kernel – for $1.2 million

What's going on

On November 4, 2026, OpenAI published the results of a large-scale security experiment. The company's security researchers built a largely autonomous pipeline: a chain of AI agents that combs through source code, finds vulnerabilities, checks whether they can be exploited and finally writes proposed fixes. They pointed it at the Linux kernel, the core of the Linux operating system. It runs on countless servers, in cloud data centers and on supercomputers, and it sits underneath every Android device.

The outcome, according to OpenAI: 948 distinct local privilege escalation (LPE) bugs. If you're already logged in to a machine with a restricted account, a bug like this lets you grab root, meaning full administrator rights. From there you control the entire system. According to Forklog, these bugs can't be exploited remotely; an attacker needs access to the device first. The work was done with an unreleased model specialized in cybersecurity, which OpenAI hasn't named.

How the pipeline works

The kernel has more than 40 million lines of code, so OpenAI didn't scan all of it. According to the Spanish site El Chapuzas Informático, agents called "Scouts" first picked out the security-relevant areas: 5,034 analysis targets totaling about 2.8 million lines, or roughly 7 percent of the kernel. The focus was mainly on code that a user without special privileges can reach. "Analyst" agents then searched those sections and flagged 2,308 potential vulnerabilities within 12 hours.

The Hacker News describes the pipeline in five stages:

1. Vulnerability discovery: The agents choose promising targets and collect suspected bugs.
2. Dynamic validation: Each suspected bug is reproduced in a sandbox, an isolated test environment where nothing leaks out. Traces from the running system are preserved along the way.
3. Exploitability check: The agents test whether the bug can be used to leak data or gain root, and build a proof of concept, a working example attack.
4. Patch generation: For every confirmed bug, the agents write a proposed fix.
5. Human review: Security researchers look over the exploit, the patch and the suggested severity rating before the report goes to the kernel maintainers, the people responsible for the code.

In a run in mid-October 2026, 1,724 of the suspected bugs were actually reproduced within 30 hours. This happened in isolated virtual machines using tools that detect memory errors.

The numbers at a glance

There are more exploits than bugs because some flaws could be exploited in more than one way. The researchers grouped the exploits by root cause and corresponding fix, which left 948 distinct vulnerabilities.

The test conditions matter. According to the reports, the exploits didn't just work because protections were switched off. The test systems ran with KASLR, which randomizes where the kernel sits in memory so attackers can't find it. SMEP and SMAP were also enabled; they stop the kernel from executing or touching code and data in the memory space of regular programs. On top of that, HARDENED_USERCOPY added extra checks when copying data. According to Forklog, the target was a mainstream desktop distribution with its default security settings.

OpenAI also ran tests in a modified version of Google's kernelCTF, a competition environment with a heavily hardened kernel. That produced 21 working exploits and 25 data-leak proofs for around $33,000. One caveat: the SLAB_VIRTUAL protection was disabled because it wasn't compatible with the chosen kernel version.

Ten new attack techniques

From a sample of 166 exploits, the researchers identified at least ten techniques they consider new. According to OpenAI, outside Linux exploit experts didn't know them either. Roughly, they break down like this:

• two new types of objects that can be used to deliberately fill the kernel cache (so-called "spraying": flooding memory with lots of crafted objects so that one lands in the right spot),
• two techniques for arranging memory pages so attacks succeed more reliably ("page grooming"),
• five "data-only" techniques that don't need any injected code and only modify data in memory to gain root, either directly or via an arbitrary write primitive,
• one technique based on type confusion, where the system treats a chunk of memory as a different data type than it actually is.

OpenAI isn't publishing the technical details for security reasons. According to Yahoo Tech, the company sees this as proof that its models aren't just recalling known tricks from their training data.

Rapid progress, new costs

OpenAI compares the run with earlier attempts. In June 2026, the GPT-5.5-Cyber model found 24 LPE exploits. In July, GPT-5.6 Sol found 166 distinct bugs for $513,690. In October, the new model found more than five times as many, even though the kernel had received numerous fixes in the meantime.

OpenAI also puts a number on the value of the work. At hacking competitions, Linux root exploits have so far paid out between $20,000 and $70,000. Extrapolated, the results would be worth $18.9 million to $66.3 million if humans had found them. That's the vendor's own back-of-the-envelope math, not a market price.

Fixing is the bottleneck

The AI patches are only proposals. Each one has to be reviewed and accepted by the kernel maintainers. On the community's advice, OpenAI started with the most critical bugs and says it has already submitted hundreds of reports. After ten days, the status was: 61 bugs fixed in the main repository, 43 patches in intermediate branches, 299 under public discussion. The rest is to be shared with partners through the "Patch the Planet" initiative. Through that initiative, OpenAI had already worked with developers and infrastructure companies in October to close two critical PHP vulnerabilities.

OpenAI writes:

"With iteration guided by human experts, we believe AI-generated patches can be functionally correct, match the existing coding style, and be robust against attack variants."

The company's warning is more pointed:

"In the short to medium term, a low-privilege account on an operating system that isn't fully patched should be treated as practically equivalent to root access for a well-resourced attacker."

OpenAI plans to limit access to its most powerful cyber models through vetted programs. According to Yahoo Tech, approved defenders get specialized tools for vulnerability research, exploit testing and mitigations through the "Daybreak Red" initiative.

The bigger picture

OpenAI isn't alone. Anthropic's Mythos model previously found 271 bugs in the Firefox browser. Just last week, according to Yahoo Tech, Anthropic reported that an unreleased version of Claude had found and exploited serious vulnerabilities in Chrome and Linux, some of them even remotely. Researchers at Vidoc Security managed to reproduce some of Mythos's findings with publicly available models for less than $30 per file. But finding a bug is one thing; building a reliable exploit against a hardened system is another.

The Hacker News cites figures from the Google Threat Intelligence Group: the number of vulnerabilities published per month more than doubled, from 5,045 in January 2026 to 10,740 in August. Over the same period, the number of high-risk bugs rose from 131 to 350. The UK's National Cyber Security Centre (NCSC) considers it "almost certain" that AI tools have sharply increased the discovery of zero-day vulnerabilities (flaws that don't have a patch yet). AI defense tools do shorten the time to patch, it says, but many systems remain vulnerable, and organizations need to adapt their patching processes to the new pace. VulnCheck classifies AI-assisted vulnerability discovery as a "growing risk category" because it also helps novices with no expertise.

Our take

The experiment shows very concretely how fast the balance of power in IT security is shifting. Work that would once have tied up expert teams for months now takes an agent chain a few days, at the price of a few used cars per hundred bugs. That's an opportunity for defenders. It's also a warning, because sooner or later the same capabilities will be in attackers' hands too.

Keep a few things in mind as you read this. All the numbers come from OpenAI's internal tests; so far there's no independent verification. Whether the ten techniques are truly new can't be checked from the outside as long as the details are withheld. And the real bottleneck is now human: of 948 bugs, only 61 had been officially fixed after ten days. Maintainer teams, mostly volunteers or thinly staffed, have to work through a flood of reports.

For Linux users and admins, the message is clear: install updates promptly, don't treat low-privilege accounts as a real security boundary, and keep the number of people with access to a system small. The danger isn't immediate, since the bugs can only be exploited locally. But pair one with a remote access vulnerability and you quickly get a full system takeover.