OpenAI's Agent Pipeline Found 948 Exploitable Linux Kernel Bugs for $1.2M

TL;DR

OpenAI's security team ran an autonomous pipeline against the Linux kernel with an unreleased cyber model and published the results on November 4 under the title "A thousand fewer paths to root". In one mid-October run it validated 948 distinct local privilege escalation (LPE) vulnerabilities with working exploits, and wrote a candidate patch for each, for $1,213,430 in API credits. That is $1,279 per path to root, while contests have historically paid $20,000 to $70,000 for a single kernel LPE. Hundreds of reports and patches are already with maintainers through Patch the Planet.

What the pipeline does

Five stages, in order: discovery, dynamic validation, exploitability assessment, patch generation, human review. Scout agents picked 5,034 audit targets, about 2.8 million lines of code, roughly 7 percent of the kernel, all reachable by an unprivileged user; that pass cost $3,426. Analyst agents working like the open-source Codex Security plugin then returned 2,308 candidate findings in 12 hours for $316,549.

Triage agents tried to reproduce each candidate inside an isolated VM running a KASAN kernel, iterating on the proof of concept from console output until the bug fired or the budget ran out. Within 30 hours, 1,724 of the 2,308 candidates had reproduced, about 74.7 percent. Only 3.1 percent were cases where the model had assumed an impossible condition. Validation cost $73,330.

ExploitDev agents took the survivors into VMs configured like a stock desktop distribution, with SMEP, SMAP, KASLR and HARDENED_USERCOPY enabled, and came back with 1,169 working root exploits plus 291 information leak proofs of concept. Variant analysis collapsed those into 948 distinct vulnerabilities, each with its own patch. The exploitation stages cost $775,929, and a successful exploit averaged about $360 in credits.

A human security researcher reviews every exploit, patch and severity rating before anything reaches a maintainer. OpenAI has already sent hundreds of reports and patches for the critical cases, following the kernel community's guidance, with Patch the Planet partners handling the rest.

The economics

OpenAI compares its $1,279 per exploit against what the market pays for the same artifact. Pwn2Own historically offered $20,000 for a Linux kernel LPE and TyphoonPWN $70,000, so 948 exploits would fetch $18.9M to $66.3M on the contest market, roughly 16 to 55 times the run's cost.

They also aimed the pipeline at kernelCTF, Google's hardened-target program, which currently pays $71,337 per accepted 0-day exploit. There the model produced 21 LPE exploits and 25 leak proofs of concept in 112 hours for $32,936, a hypothetical $1.5M payout if all are accepted, about 45 times the spend. For scale: 26 confirmed 0-day LPE exploits have been accepted by kernelCTF in all of 2026.

The model-to-model jump matters most for defenders. GPT-5.6 Sol found and exploited 166 unique LPEs in late July for $513,690. Three months of kernel hardening later, the newer model found 948. In June, GPT-5.5 Cyber had managed 24. OpenAI's stated takeaway: rescan previously audited code with each frontier model, because the new model finds what the old one missed.

The catches

• An early run reported 200 successful exploits. Human review found 20 of them had reached root through a different 0-day than the one assigned, the software equivalent of passing the exam with someone else's answer sheet. OpenAI added an independent check that each final exploit uses its assigned vulnerability.
• Maintainers are fast. While the 10-day scan ran, 61 of the LPEs were patched upstream, 43 had staging patches, and 299 were being discussed in public.
• The model is unreleased, so none of this is independently reproducible yet. OpenAI also calls its costs an upper bound from a methodology-focused run, and expects harness engineering to push them down.
• Sampled exploits used at least 10 exploitation techniques that third-party kernel experts confirmed were new: two sprays built on new persistent elastic objects, two page grooming methods, five data-only techniques, one type confusion. Details are withheld.
• In the kernelCTF run, an agent assigned to syscall entry code hit an unexpected crash, traced it to a QEMU TCG bug in its own test VM, and wrote an exploit for that too. Upstream QEMU had already fixed it; the release build had not. Hired to audit the kernel, it found a bug in the furniture.

What this means if you ship software

OpenAI's defense guidance is blunt: for the near and medium term, treat a low-privileged account on a machine that is behind on patches as equivalent to root for a well-resourced attacker. Sandboxing and isolation such as Firecracker and gVisor are how you shrink the blast radius once that assumption holds.

Two operational lessons generalize beyond security teams. The bottleneck moved: discovery is now the cheap stage, and validation and triage are what cost money and attention, so any agent pipeline that produces findings needs the reproduce-and-verify step built in. And scaffolding has a shelf life. A library of 103 kernel exploitation techniques lifted GPT-5.5 Cyber's success rate from 76.2 percent to 88.9 percent, but on GPT-5.6 Cyber the same layer added 1.5 percentage points, so OpenAI deleted it.

Patch generation earned its keep here as well. The prototype wrote all 948 candidate patches, and in a few cases it found problems in patches written by human experts, which were fixed before merge.

Key Takeaways

• OpenAI's autonomous pipeline, running an unreleased cyber model, validated 948 unique Linux kernel local privilege escalation vulnerabilities in a single mid-October run, each with a working exploit and a candidate patch.
• Total cost was $1,213,430 in API credits, or $1,279 per LPE, against historical contest bounties of $20,000 to $70,000 each; by public payout rates the run was profitable.
• Reports and patches are already reaching maintainers through Patch the Planet, critical vulnerabilities first, per the kernel community's guidance.
• The funnel: 2,308 candidate findings became 1,724 reproduced bugs, then 1,169 working exploits, then 948 distinct vulnerabilities after variant analysis. Only 3.1 percent of candidates assumed impossible conditions.
• Model generation dominates: GPT-5.5 Cyber found 24 LPEs in June, GPT-5.6 Sol found 166 in July, and the October model found 948, despite three months of upstream hardening between scans.
• Assume an unprivileged foothold on an unpatched box is root. Isolate with Firecracker or gVisor, keep kernels current, and rescan critical code each time a frontier model ships.

Sources: OpenAI, A thousand fewer paths to root, OpenAI, Patch the Planet, Google kernelCTF rules, OpenAI on X, Greg Brockman on X, Dealroom News