OpenAI's upcoming cyber model built 948 Linux root exploits for $1.2M

On 4 November 2026, OpenAI published "A thousand fewer paths to root", a write-up of an autonomous pipeline that looks for Linux kernel vulnerabilities, proves they can be exploited and drafts patches. Powered by what OpenAI calls "an upcoming cyber model", one run produced 948 unique local privilege escalation (LPE) vulnerabilities, bugs that let an unprivileged local user become root, at an API cost of $1.2 million.

The mid-October run in numbers

All figures below come from OpenAI's post:

• Targets: Scout agents picked 5,034 audit targets, about 2.8 million lines of code, roughly 7% of the kernel.
• Candidates: analyst agents produced 2,308 candidate findings after deduplication, within 12 hours.
• Reproduced: 1,724 vulnerabilities were dynamically reproduced in isolated virtual machines, about 74.7% of candidates. OpenAI says only 3.1% of findings reflected incorrect analysis by the model.
• Exploited: agents produced 291 information leak proofs of concept and 1,169 working LPE exploits. After variant analysis, OpenAI wrote 948 distinct patches and uses that number as the count of unique LPEs.
• Cost: $1,213,430 in API credits in total, or $1,279 per LPE exploit.

The target machines ran "a stock desktop operating system, not a weakened target", with standard protections such as SMEP, SMAP and KASLR enabled. OpenAI says it focused on capability rather than cost, so the reported costs are "more an upper bound".

How the pipeline works

OpenAI describes five stages: vulnerability discovery, dynamic validation, exploitability assessment, patch generation, and human review. For each finding the system bundles a root cause analysis, a minimal crashing proof of concept, a candidate patch and a full exploit. Security researchers review the exploit, patch and proposed severity before anything reaches maintainers (OpenAI).

One early incident shows why that last step matters. In an early run, 20 of 200 "successful" exploits had reached root through a different zero-day than the one the agent was assigned. OpenAI then added an independent check that each exploit used its assigned vulnerability (OpenAI).

Bounty maths: OpenAI's own hypothetical

OpenAI frames the cost against public bug bounties. It says Pwn2Own and TyphoonPWN historically offered $20,000 and $70,000 for Linux kernel LPE exploits. Applying those amounts to the 948 exploits gives what OpenAI calls "a hypothetical valuation of $18.9M—$66.3M, approximately 16x to 55x our pipeline's cost" (OpenAI). That is OpenAI's estimate, not money paid.

A second test targeted Google's kernelCTF, a hardened kernel with a reduced attack surface. Over 112 hours and roughly $32,936 in API credits, the pipeline produced 25 information leak proofs of concept and 21 LPE exploits. For comparison, OpenAI notes kernelCTF has accepted 26 confirmed zero-day LPE exploits in 2026 so far. If all 21 were accepted, OpenAI estimates a bounty of around $1.5M, about 45x the cost (OpenAI). Its conclusion: based on public payouts, the pipeline "was net profitable at the time of this research".

Newer models find much more

The jump between model generations is the striking part. In June, as part of OpenAI's Patch the Planet initiative, GPT-5.5 Cyber had developed 24 LPE exploits. In late July, GPT-5.6 Sol found and exploited 166 unique LPEs for $513,690. The mid-October run with the newer cyber model reached 948, on the latest kernel master branch in both cases (OpenAI).

OpenAI also says that, to the best of its knowledge, the agents used at least 10 new Linux exploitation techniques, which outside kernel exploitation experts had not seen either. It withholds the technical details "for safety reasons" (OpenAI).

Patches and maintainers

OpenAI says it has already sent hundreds of reports and patches for critical vulnerabilities, following guidance from the Linux kernel community, and is working with Patch the Planet partners on the rest, as part of its Daybreak commitment to open-source projects. Maintainers moved fast: when the 10-day scan and analysis finished, 61 LPEs were already patched upstream, 43 had staging patches and 299 were being discussed publicly (OpenAI).

Why it matters

OpenAI's practical advice is blunt: for the near and medium term, a low-privileged account on an operating system that is not up to date on patches "should be considered functionally equivalent to root access for a well-resourced threat actor". It recommends sandboxing and isolation such as Firecracker and gVisor to limit the damage (OpenAI).

For anyone running AI coding agents on shared machines or CI runners, the takeaway is simple: keep kernels patched and treat local access as a serious boundary. OpenAI is also paying outsiders to find flaws in its own products, as covered in our piece on its bug bounty of up to $172,000.