OpenAI Says Its Autonomous Pipeline Built 948 Linux Root Exploits in One Run for $1.2 Million

OpenAI said today, Nov. 4, that an autonomous vulnerability pipeline produced 948 working local privilege escalation (LPE) exploits against the Linux kernel in a single run. The total API bill was $1,213,430. That averages out to about $1,279 per exploit.

An LPE lets someone with ordinary, unprivileged access to a machine become root. OpenAI counted an exploit as a success only when it actually obtained a root shell.

What the run did

The run took place in mid-October against the kernel's master branch, using what OpenAI calls "an upcoming cyber model." That model has not been released.

OpenAI's numbers, as published:

• 2,308 candidate kernel findings identified and analyzed
• 1,724 vulnerabilities reproduced dynamically in isolated virtual machines
• 948 LPE exploits that gained root
• 291 proofs of concept for information leaks

The workflow has several stages. Scout agents pick the parts of the kernel worth auditing. Analyst agents read the code for flaws. Triage agents reproduce each candidate in a VM. Exploit agents try to turn confirmed bugs into root access. A patch stage then drafts fixes. Human researchers reviewed the outputs and reported the vulnerabilities alongside the patches.

OpenAI says the target was "a stock desktop operating system, not a weakened target," with SMEP, SMAP, KASLR and hardened usercopy protections enabled.

The cost math

OpenAI says a successful exploit cost $359 on average, while failures were far more expensive: $3,922 each across 69 cases, driven largely by race conditions that ate time. The $1,279 figure is the whole bill divided by the exploit count.

OpenAI also priced the work against the market. It says Pwn2Own and TyphoonPWN have historically paid $20,000 and $70,000 for a Linux kernel LPE. By its math, 948 such exploits would be worth $18.9 million to $66.3 million, or "approximately 16x to 55x our pipeline's cost."

On Google's hardened kernelCTF target, the pipeline produced 21 LPE exploits and 25 information leaks for about $32,936. OpenAI notes that kernelCTF has accepted 26 confirmed 0-day LPE exploits in all of 2026 so far.

OpenAI says the figures are an upper bound. It says it optimized for measurement, not price, and that "sufficient harness engineering could meaningfully reduce the cost at each stage."

Escalation since June

The jump from earlier efforts is steep. In June, under its Patch the Planet initiative, OpenAI said GPT-5.5 Cyber had found Linux kernel flaws and built 24 LPE exploits. In late July, the same harness running GPT-5.6 Sol produced 166 unique LPE vulnerabilities for $513,690.

The new run reached 948 on a kernel that had been hardened in the interim. OpenAI's explanation: "A more capable model may uncover vulnerabilities that earlier models missed, even when using the same research harness."

The comparison is not clean. The June figure came from a model, and the new one comes from a purpose-built pipeline. Scope may differ.

OpenAI also claims the agents used at least 10 exploitation techniques that were new to the third-party kernel experts it consulted, including new object-spraying and page-grooming methods. That claim comes from OpenAI and the experts it chose to show the work to.

The patching backlog

Finding bugs is the easy part now. Fixing them is not.

As of the announcement, 61 of the vulnerabilities had been fixed upstream, with another 43 moving through a staged patch process. That is 104 of 948. OpenAI says maintainers moved fast, with the 61 patches landing within the roughly 10 days the scan took. It says it has sent hundreds of reports and fixes to Linux maintainers.

OpenAI describes the bottleneck itself: "Vulnerability discovery is becoming easier to scale, but prioritization and validation remain operational bottlenecks." It says it followed guidance from the Linux kernel community and began with critical vulnerabilities. It is working with Patch the Planet partners on further reports and patches.

The same capability cuts the other way. A pipeline that can mass-produce working root exploits for about $1,279 apiece is a defensive tool in OpenAI's hands. OpenAI's own conclusion is blunt: a low-privileged account on a system that is not up to date on patches "should be considered functionally equivalent to root access for a well-resourced threat actor."

LPEs are not a front door. An attacker needs an initial foothold first, such as stolen credentials, malware or a separate vulnerability. That is a real barrier, but attackers routinely chain an LPE to a separate entry point.

What OpenAI tells defenders

Its advice is sandboxing and isolation, and it names Firecracker and gVisor. It also recommends rescanning old code with each new model generation and using automated patch generation to keep pace with discovery.

What comes next

The 948 exploits sit behind a patch queue run by human maintainers. OpenAI has not released the model that powered the run. The open question is how fast upstream can clear the remaining roughly 840 bugs, and whether anyone outside OpenAI can reproduce the numbers on that timeline.