OpenAI's cyber model found 948 Linux root exploits for $1.2 million

An autonomous OpenAI pipeline using an upcoming cyber model generated 948 working local privilege escalation exploits against a stock Linux distribution in mid-October 2026, at a total API cost of $1,213,430 — or $1,279 per root exploit. The run, disclosed in a research post from OpenAI's Cyber team, marks a shift in vulnerability research from one-off investigations to a systematic, industrial process, and it lands amid a debate over whether frontier models will advantage attackers or defenders first.

The stakes are broad. The Linux kernel runs Android devices, cloud infrastructure and supercomputers used by billions of people, and exposes an attack surface of more than 40 million lines of code across system calls, networking, filesystems and device drivers. OpenAI said it chose Linux to measure how effectively frontier models could find and demonstrate vulnerabilities in a codebase of this scale.

What did the pipeline actually find?

The October run scanned the latest Linux kernel master branch and produced 2,308 candidate findings after deduplication. Dynamic validation reproduced 1,724 vulnerabilities — 74.7% of candidates. Exploit development agents then built 291 information leak proofs of concept and 1,169 working local privilege escalation exploits. Variant analysis collapsed those exploits to 948 distinct vulnerabilities, each with a generated patch.

The target machines ran a stock desktop operating system, not a weakened build, under the same threat model used by competitions such as Pwn2Own and TyphoonPWN. Historical bounties of $20,000 (Pwn2Own) and $70,000 (TyphoonPWN) per Linux kernel LPE imply a hypothetical valuation of $18.9 million to $66.3 million for the 948 exploits — roughly 16x to 55x the pipeline's cost.

The same pipeline, run against Google's hardened kernelCTF environment, obtained 25 information leak PoCs and 21 LPE exploits in 112 hours for about $32,936. For comparison, 26 confirmed 0-day LPE exploits had been accepted by kernelCTF in all of 2026 at the time of writing. If the 21 vulnerabilities were accepted, OpenAI estimated roughly $1.5 million in bounty awards, about 45x the scanning cost.

"Based on public pay-out amounts, with current cyber-capable models, our vulnerability research pipeline was net profitable at the time of this research," the team wrote. "Defenders should proactively analyze their software so that it becomes cost prohibitive for attackers to exploit."

How does the five-stage pipeline work?

The system chains five stages, with human security researchers reviewing results at the end:

• Vulnerability discovery. Scout agents identified 5,034 audit targets covering about 2.8 million lines of code — roughly 7% of the kernel — selected for reachability by low-privileged users and security relevance. Cost: $3,426.
• Dynamic validation. Within 12 hours, analyst agents produced 2,308 candidate findings using a workflow similar to the Codex Security plugin, at a cost of $316,549. Triage agents then built proofs of concept and ran them on KASAN-instrumented kernels. Within 30 hours, 1,724 vulnerabilities reproduced. Only 3.1% of failures reflected incorrect model analysis; the rest required elevated privileges or failed on race conditions, specific trigger conditions or slow validation paths such as refcount wraparound. Cost: $73,330.
• Exploitability assessment. A permissive screening agent narrowed the field to 313 information leak and 1,238 LPE candidates. ExploitDev agents tested them on VMs with SMEP, SMAP, KASLR and HARDENED_USERCOPY enabled. Cost: $44,194 for screening, $775,929 for exploitation.
• Patch generation. The system produced 948 distinct patches after variant analysis, prompted with best practices including static patch checks and conformance with nearby code conventions.
• Human review. Researchers reviewed each exploit, patch and proposed severity before reporting to maintainers.

The cost asymmetries are instructive. Successful exploits averaged $360 to develop; 69 unsuccessful attempts averaged $3,922 each, driven by a few hard cases such as race conditions. Processing an LPE candidate ($558) cost about twice an information leak candidate ($271), because leak PoCs carried over from validation with little modification. The team noted that a reasonable give-up condition, such as stopping after an hour without progress, would have cut ExploitDev costs significantly, and that reported costs are an upper bound rather than an optimization target.

Did the models invent new attack techniques?

Yes. Sampling 166 agent-built exploits, the team identified at least 10 novel exploitation techniques, confirmed as new by third-party kernel exploitation experts. The set includes two new persistent elastic objects for cache spraying, two page grooming techniques for exploit reliability, five data-only privilege escalation techniques, and one arbitrary type confusion. OpenAI withheld technical details for safety reasons.

"Frontier models do not just pattern match known vulnerable code patterns or solely use known exploitation techniques; they demonstrate creativity and novel approaches," the team wrote.

The October run also found more than five times as many novel LPEs as a GPT-5.6 Sol run in late July 2026, which found and exploited 166 unique LPEs for $513,690 — despite three months of kernel hardening between scans. The takeaway, per OpenAI: rescan previously audited code as capabilities improve.

What went wrong, and what did the community do?

An early run reported 200 successful LPE exploits; human review found 20 had reached root through a different 0-day than the one assigned. OpenAI tightened constraints and added independent checks confirming each exploit used its assigned vulnerability. "For autonomous security research, verify the path to a result in addition to verifying the result itself," the team wrote.

The kernelCTF run surfaced an unplanned finding: an analyst agent assigned to system call entry code triaged an unexpected kernel crash to a QEMU TCG vulnerability — without access to QEMU's source — and the ExploitDev agent subsequently built an LPE for it. The bug had been fixed upstream but not in the release build used in the experiment. OpenAI said it has proactively tested its own infrastructure and disclosed vulnerabilities in Kata, Moby/Docker, gVisor and other projects.

The Linux maintainer community moved fast during the scan. Within 10 days, 61 LPEs had been patched upstream, 43 had staging patches, and 299 were being publicly reported and discussed. "This collective response is what's needed to secure the world's software," the team wrote. OpenAI has already sent hundreds of reports and patches for critical vulnerabilities, prioritized at the community's suggestion, and is coordinating remaining patches with Patch the Planet partners under its Daybreak initiative.

Why does this matter beyond Linux?

OpenAI's framing is blunt: given the rate of discovery by frontier models, automated patch generation is essential to shrink the exploitation window, and access to a low-privileged account on an unpatched system should now be considered "functionally equivalent to root access for a well-resourced threat actor." The team recommends defense in depth with isolation approaches such as Firecracker and gVisor.

The team also argues that large codebases will need repeated scan-and-fix rounds with each model generation to bottom out latent bugs, and that a world with no unknown vulnerabilities demands high-assurance software: models trained to write secure code by default, minimized attack surfaces, and formal verification for core software such as operating systems, browsers, image parsing libraries and the TCP/IP stack.

The July-to-October capability jump — 166 to 948 exploits in three months — sets the baseline for what the next model generation may find, and OpenAI says it intends to keep scanning: "Every generation of models should help us build software that the next generation finds harder to compromise."