OpenAI’s upcoming AI model built 948 working Linux root exploits in a single run
An automated system running on an upcoming AI model turned hundreds of Linux kernel bugs into working exploits that give an ordinary user root access, and wrote a patch for each underlying flaw, OpenAI revealed in a new research post.
Source:OpenAI
The company’s Cyber team ran the pipeline in mid-October 2026 against the latest Linux kernel, with target machines running a stock desktop operating system from a commonly used distribution. The run ended with 948 local privilege escalation (LPE) exploits and cost $1,213,430 in API credits, or $1,279 per exploit.
“Security research that once required a separate, sustained investigation for each finding can increasingly be run as a systematic process,” the team wrote.
The researchers explained that they chose Linux because the kernel powers Android devices, cloud infrastructure, supercomputers and other systems used by billions of people, and its more than 40 million lines of code expose a wide attack surface through system calls, networking, filesystems and device drivers.
They wanted “to study how effectively frontier models could find vulnerabilities and demonstrate their security impact in a codebase of this scale and importance.”
“The initial vulnerability discovery stage produced thousands of candidate findings, too many for security researchers to manually review and triage. The operational challenge of our vulnerability discovery pipeline was not discovery, but determining which findings could be reproduced, what security boundary they crossed, and which warranted the earliest maintainer attention,” OpenAI stated.
From 2,308 leads to working root exploits
To narrow the search, a first group of AI agents picked out the parts of the kernel that low-privileged users can reach and that matter for security, leaving about 7% of the code base to audit.
A second group went through that code and came back with 2,308 possible bugs within 12 hours. Triage agents then tried to trigger each one inside isolated virtual machines and managed to reproduce 1,724 of them in 30 hours, or 74.7%. Researchers said they “were impressed by the accuracy of the analyst agents” at this stage.
Exploit-development agents tested the most promising bugs on machines with the standard protections of a regular Linux distribution switched on. They produced 291 proofs of concept for information leaks and 1,169 working root exploits. After grouping exploits that traced back to the same flaw, OpenAI counted 948 distinct vulnerabilities.
Techniques new to human experts
A sample of 166 exploits showed the agents had used 10 exploitation techniques that, to the researchers’ knowledge, had not been seen before.
“We shared the exploitation techniques with third-party kernel exploitation experts and the techniques were new to them as well,” the team added.
OpenAI kept the technical details out of its post, as they explain, due to safety reasons.
Root through the wrong door
The agents’ self-reported results did not always hold up. In an early run, the exploitation stage claimed 200 successful root exploits, but human review showed that 20 of them had reached root through a different zero-day than the one the agent was assigned.
“This suggests that even successful exploitation by agents needs proper validation,” the post notes. OpenAI tightened the task rules and added an independent check that confirms each exploit uses the bug it was meant to.
Security researchers review every exploit, patch and proposed severity rating before anything goes to kernel maintainers.
Maintainers move fast
By the time the scan and manual analysis wrapped up after 10 days, 61 of the privilege escalation bugs had been patched upstream, 43 had staging patches and 299 were being reported and discussed publicly.
OpenAI says it has sent out hundreds of reports and patches so far, starting with the most serious flaws at the suggestion of the Linux kernel community, and is working with partners in its Patch the Planet initiative to send the rest.
“We greatly appreciate the Linux maintainers who have been working urgently to patch identified issues, and the broader security community contributing their findings as well,” the company noted. “The rapid rate of vulnerability disclosure and patching also emphasizes the criticality for users and companies to keep software up to date.”
Cheaper than a bug bounty
Pwn2Own and TyphoonPWN have historically paid $20,000 and $70,000 respectively for a Linux kernel privilege escalation exploit. Using those amounts, OpenAI puts a hypothetical value of $18.9 million to $66.3 million on the exploits from the October run.
The pipeline was tested on an adapted version of Google’s kernelCTF, a hardened kernel with a reduced attack surface. Over 112 hours and $32,936 in API credits, it produced 21 privilege escalation exploits and 25 information leak proofs of concept.
By comparison, kernelCTF has accepted 26 confirmed zero-day privilege escalation exploits in 2026. OpenAI estimates the 21 would bring in about $1.5 million if the program accepted them, and concluded that its pipeline “was net profitable at the time of this research.”
Unpatched means exposed
“For the near and medium term, having access to a low-privileged account on an operating system, that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor,” the researchers warned.
They recommend layered defenses, including sandboxes and isolation tools like Firecracker and gVisor, to limit the damage when a vulnerability is exploited.
“Within the next few years, we believe that if there are vulnerabilities in a given software project, frontier models will likely be able to discover them and even less capable models may be able to develop exploits once disclosed,” OpenAI concluded.
