OpenAI has turned security research into a production line for Linux kernel flaws, reporting 948 working exploits that could lift an ordinary local user to root access. The mid-October run scanned the latest Linux kernel, reproduced most candidate findings in isolated machines, and drafted a candidate patch for each distinct flaw. Human researchers reviewed the results before reports went to kernel maintainers, with the most critical cases sent first and the rest following gradually.
From thousands of candidates to 948 distinct flaws
The pipeline worked in five stages, starting with Scout agents that picked 5,034 audit targets covering about 2.8 million lines of code. That target set was roughly 7 percent of the kernel, and Analyst agents then produced 2,308 deduplicated candidate findings within 12 hours.
Triage agents reproduced 1,724 of those vulnerabilities within 30 hours, running proofs of concept in virtual machines with kernel address sanitizer enabled. Only 3.1 percent of the remaining findings reflected incorrect model analysis, while most others needed elevated privileges or more time to reproduce.
Screening narrowed the validated flaws to 313 information-leak candidates and 1,238 local privilege escalation candidates for the next stage of testing. Exploit agents tested them on a stock desktop Linux system with standard protections on, producing 291 information-leak proofs and 1,169 working privilege escalation exploits.
Variant analysis grouped those exploits into 948 distinct vulnerabilities, each with its own candidate patch, so the headline counts flaws rather than merged fixes. The protections left switched on included supervisor-mode execution prevention, supervisor-mode access prevention, address-space randomisation, and hardened usercopy.
What the run cost, and what changed since July
OpenAI put the full run at $1,213,430 in API credits, or about $1,279 per distinct flaw, and called those costs an upper bound. The work measured capability rather than efficiency, so better harness engineering could meaningfully cut the cost at each stage.
Discovery cost $316,549, validation $73,330, screening $44,194, and the exploitation stage $775,929, while scouting cost just $3,426. A late-July run with GPT-5.6 Sol found 166 unique flaws for $513,690, so the newer model found over five times as many despite three months of extra hardening.
Both runs scanned the latest kernel master branch available at the time, so the jump measures model improvement rather than a softer target. OpenAI also tested the pipeline against Google’s kernelCTF reward programme, producing 25 information-leak proofs and 21 privilege escalation exploits in 112 hours.
That campaign cost about $32,936 and dropped one kernelCTF mitigation it could not support, so its results are not directly comparable with the main run. Its roughly $1.5 million bounty figure is conditional on all 21 flaws being accepted, not an award already paid to OpenAI.
New techniques, and a failure the team caught
In a sample of 166 exploits, OpenAI said the agents used ten techniques that its team and outside kernel experts believed were new. They spanned persistent elastic objects, page grooming, data-only privilege escalation, and arbitrary type confusion, with full details withheld for safety.
The novelty claim therefore rests on that sampled expert review, not on public verification of every technique in the full set. A separate test also found a vulnerability in QEMU’s testing infrastructure, already fixed upstream but not in the release build used.
The report is candid about a measurement failure in an early run, when 20 of 200 reported successes reached root through a different flaw than assigned. OpenAI tightened the task constraints and added an independent check confirming that each final exploit used its assigned vulnerability.
That correction matters because a root shell alone does not prove which flaw produced it, and the same discipline will matter for reproduction attempts. OpenAI said additional instructions and iteration improved patch quality, showing that machine-written patches can become correct, minimal, and consistent with nearby code.
Patching is now the bottleneck
By the time the ten-day scan and manual analysis finished, 61 flaws had been patched upstream, 43 had staging patches, and 299 were publicly reported or discussed. OpenAI credited that pace to kernel maintainers, and hundreds of reports and patches for critical flaws have already gone out to them.
The rest will follow gradually through partners in its Patch the Planet programme, which pairs AI-assisted research with expert review. Maintainers keep control over deployment and disclosure, and the programme began in June with GPT-5.5 Cyber finding 24 privilege escalation flaws.
That scale creates a second problem, because every validated flaw still needs a human-reviewed patch that fits kernel coding conventions. If automated discovery keeps outrunning maintainer review, the backlog itself becomes a risk, with known flaws waiting while attackers and defenders race.
In a few cases the prototype also spotted issues in patches written by human experts, which were fixed before those patches were merged. That two-way benefit is part of OpenAI’s case for the programme, even as the sheer volume of machine-found flaws tests maintainer capacity.
Why It Matters
The result reframes frontier models in security, shifting the scarce resource from finding bugs to proving them, pricing them, and fixing them first. OpenAI valued the 948 flaws at a hypothetical $18.9 million to $66.3 million under historical competition bounties, against a $1.21 million run cost.
Those bounty figures are illustrative rather than income, but they show why defenders can no longer assume that finding a flaw is the expensive part. Keeping systems patched therefore matters more than ever, since the cost of discovery has fallen faster than the cost of safe, reviewed fixes.
For users, the practical message is narrower than the headline, because these are local privilege escalation flaws that first need an ordinary local foothold. They are most dangerous when chained with another flaw or a careless configuration, and most manageable through prompt patching and least-privilege access.
Rivals will read the same lesson, since Anthropic has already disclosed its own model-built exploits, and the contest now turns on merged fixes. The lab that turns machine-found flaws into accepted patches fastest will set the pace, while the others absorb the reporting backlog.
Background
OpenAI launched Patch the Planet with Trail of Bits in June 2026 as a Daybreak initiative, pairing a cyber model with human reviewers who check findings before maintainers see them. Linux was chosen because it underpins Android, cloud systems, and supercomputers, with over 40 million lines spanning calls, networking, and drivers.
Source: OpenAI research post and Hacker News report
0 Comments