OpenAI's AI Agents Build 948 Working Root Exploits for the Linux Kernel in a Single $1.2 Million Run
OpenAI says an autonomous pipeline built on an upcoming cyber model reproduced 1,724 Linux kernel vulnerabilities and turned 948 of them into working root exploits, each with a candidate patch, for $1.21 million in API credits.
OpenAI has shown that an artificial intelligence system can now hunt for security flaws in the Linux kernel, prove each one with a working exploit and draft a patch for it — at a scale and speed no human team could match. In a single run in mid-October 2026, the company's autonomous cyber pipeline produced working exploits for 948 distinct local privilege-escalation vulnerabilities in the kernel, the core of the operating system that powers most of the world's servers, smartphones and cloud infrastructure.
The results were published on 4 November 2026 in a research post titled "A thousand fewer paths to root", written by OpenAI's Cyber team. A local privilege-escalation flaw, usually shortened to LPE, lets someone who already holds an ordinary, low-privileged account on a machine raise that account to root — the account that controls the entire system. OpenAI counted an exploit as a success only when it produced a working root shell.
The pipeline ran in five stages: discovery, dynamic validation, exploitability assessment, patch generation and human review. Scout agents first selected 5,034 audit targets covering about 2.8 million lines of code, roughly 7 per cent of a kernel that contains more than 40 million lines. The system then analysed 2,308 candidate findings, and a triage agent tested each one inside a virtual machine running a kernel with Kernel Address Sanitizer switched on. Within 30 hours it had reproduced 1,724 of them as real vulnerabilities, about 74.7 per cent of the candidates.
From there, exploit-development agents went to work on the strongest candidates. They produced 291 proofs of concept for information leaks and 1,169 working local privilege-escalation exploits. Variant analysis then grouped exploits that traced back to the same underlying flaw, and that grouping is where the headline figure of 948 comes from: 948 distinct vulnerabilities, each backed by its own candidate patch. The company was careful to stress that these are candidate patches for maintainers to review, not fixes that have already shipped to anyone's machine.
The whole run cost $1,213,430 in API credits, which works out at about $1,279 per distinct flaw. OpenAI described that total as more of an upper bound than a tuned price. Exploitation was by far the most expensive stage, at $775,929 of the total, while a successful exploit cost $359 on average. The company estimated that the 948 exploits would have fetched between $18.9 million and $66.3 million if priced at the bounty rates paid at competitions such as Pwn2Own and TyphoonPWN — between 16 and 55 times what the run cost.
The test was not run against a weakened laboratory build. OpenAI said the target machines ran a stock desktop operating system with the standard kernel protections a normal distribution ships with — SMEP, SMAP, KASLR and HARDENED_USERCOPY — all switched on. The pipeline also surfaced at least 10 exploitation techniques that outside kernel experts had not seen before, including new ways to spray kernel memory and data-only paths to root, found in a sample of 166 exploits. OpenAI said only 3.1 per cent of the model's findings were outright mistakes.
The result is a sharp step up from OpenAI's earlier work in the same area. The pipeline builds on the company's Patch the Planet initiative, part of its Daybreak programme, under which an earlier model, GPT-5.5 Cyber, developed 24 local privilege-escalation exploits. A run in July 2026 using a GPT-5.6 model found and exploited 166 flaws at a cost of $513,690. The new run found more than five times as many novel flaws despite three months of kernel hardening in between.
The disclosure follows a similar milestone from a rival laboratory. Anthropic recently reported that its Claude model had found a Linux root flaw, CVE-2026-98432, and built a working exploit for it in 53 minutes, and the Xen project has credited Claude with discoveries that led to official security advisories and patches. The two announcements together suggest that AI-driven vulnerability research has moved from a curiosity to a practical tool that the major laboratories are now using routinely.
OpenAI said it has already begun reporting the critical flaws to the Linux community with its partners, and that hundreds of reports and candidate patches have gone to the kernel's maintainers. By the time the scan and the manual analysis were finished, 10 days after the scan itself, 61 of the flaws had already been patched upstream, 43 had patches in staging, and 299 were being reported and discussed in public. For safety reasons, the company withheld the technical details of the exploits and has not published the exploit code.
The findings carry a blunt warning for anyone running Linux systems. OpenAI's guidance is that an unpatched system with a low-privileged account should be treated as equivalent to root access for a well-resourced attacker. The same technology that can now find and patch flaws at this pace could also be used by attackers, which is why the company says every exploit, patch and severity rating passes a human review before anything reaches a maintainer. What happens next depends on how quickly the kernel community can absorb nearly a thousand candidate patches — and on whether defenders adopt the same automated methods before attackers do.
More in Technology & AI
Photo: Anthropic chief executive Dario Amodei in 2023 (file image)
Technology & AIAnthropic lets Claude read your bank account with new Personal Finance tool — but it cannot move a cent
Anthropic has launched Personal Finance in Claude, a read-only beta that links US bank and card accounts through Plaid so users can ask where their money goes — while the chatbot stays unable to move, manage or invest a cent.
Photo: Meta Platforms headquarters in Menlo Park, California (file image)
Technology & AIMeta opens video chats with its AI agent Muse to everyone in the US as Muse Voice goes live
Meta has switched on Muse Voice for all users in the United States, letting them call and video chat with its personal AI agent through a real-time voice conversation and an expressive animated avatar.
Photo: The TikTok app on a smartphone screen (file image)
Technology & AIPTA dismisses fake TikTok ban notification as ‘false and misleading’, says no order issued
The Pakistan Telecommunication Authority said on Thursday that no notification banning TikTok had been issued, after a fabricated document claiming a nationwide suspension spread across social media.