OpenAI says its agents built 948 Linux kernel exploits for $1.2 million

OpenAI says its AI agents built working Linux kernel exploits for 948 distinct vulnerabilities, each one able to turn an ordinary local user into root. The company published the report on November 4, 2026. By its own count, the mid-October run cost $1,213,430 in API credits, or about $1,279 per exploit. We found no independent check of these numbers yet, so the pipeline figures below are OpenAI's.

What did OpenAI's agents find in the Linux kernel?

OpenAI built a five-stage pipeline around an upcoming cyber model that it has not named. Agents pick the parts of the kernel worth auditing, scan them for bugs, reproduce each bug in an isolated virtual machine, try to exploit it, and write a candidate patch. Human security researchers then review the results before anything goes to the maintainers.

The scan ran on the latest Linux kernel master branch in mid-October 2026. Scout agents chose 5,034 audit targets, about 2.8 million lines of code, or roughly 7% of the kernel. Analyst agents turned those into 2,308 candidate findings in 12 hours. Within 30 hours, triage agents reproduced 1,724 of them, about 74.7%.

The exploit stage is the headline, because it produced the Linux kernel exploits themselves. Each of these bugs is a local privilege escalation (LPE): someone who can already log in as a normal user becomes root. OpenAI says the exploits worked on a stock desktop operating system with standard protections switched on, including SMEP, SMAP and KASLR. The agents also produced 291 proofs of concept for information leaks.

Why does the report say both 948 and 1,169?

Because the two numbers count different things. OpenAI's summary speaks of "948 working local privilege escalation (LPE) exploits." Further down, the same report says the agents produced "1,169 working local privilege escalation exploits."

The gap comes from deduplication. OpenAI ran variant analysis and wrote "948 distinct patches for the vulnerabilities behind those exploits", then used that number as its count of unique LPEs. So 1,169 is the raw tally of working exploits, and 948 is the number of distinct holes they open, one candidate patch each.

One more caveat matters here. The 948 patches are candidates for maintainer review, not merged fixes. OpenAI also does not name the distribution it targeted. It calls it only "a commonly used Linux distribution."

How much did the Linux kernel exploits cost?

The full run cost $1,213,430 in API credits, according to OpenAI. Divided by 948, that is about $1,279 per distinct exploit. Most of the money went to exploit development, which alone cost $775,929.

Some costs are much lower than the headline. A successful exploit cost $359 to develop on average. Failed attempts cost far more, averaging $3,922 across 69 cases, driven by a few hard cases such as race conditions. OpenAI says better engineering around the model could cut costs at every stage, so it treats its figures as "more an upper bound."

OpenAI also ran a smaller test against Google's kernelCTF, a hardened kernel with less attack surface. That campaign cost about $32,936 and yielded 21 LPE exploits. If kernelCTF accepted all 21, OpenAI estimates the rewards at around $1.5 million.

What would 948 Linux kernel exploits be worth?

OpenAI puts a hypothetical value of $18.9 million to $66.3 million on them. It reached that range by applying past bounty prices for Linux kernel LPEs at two hacking contests: $20,000 at Pwn2Own and $70,000 at TyphoonPWN. That is 16 to 55 times what the run cost.

Treat this as a thought experiment, not a market price. No contest would pay for 948 entries at once, and a bug loses value as soon as it is patched. Still, the point stands: by OpenAI's math, finding and proving kernel bugs at this scale now costs far less than the bugs used to fetch.

Have the vulnerabilities been fixed?

Some of them. OpenAI says it has sent "hundreds of reports and patches for critical vulnerabilities" to the kernel maintainers, starting with the most severe bugs, as the Linux community asked. It plans to send the rest gradually with partners in Patch the Planet, part of its Daybreak program for open-source security.

When the scan and manual analysis finished after 10 days, OpenAI says 61 of the LPEs had already been patched upstream and 43 had patches in staging. Another 299 were being reported and discussed in public. However, the report's summary credits those 100-plus fixes to "other contributors", not to OpenAI's own patches. OpenAI does not say how many of those 104 overlap with its 948.

So the fix count says little about how many of OpenAI's bugs are closed. Most of its candidate patches still await maintainer review, and distributions need time to ship kernels with any fixes that land.

How do these Linux kernel exploits compare with earlier AI work?

They are a big jump in scale. In June, OpenAI said GPT-5.5 Cyber had built 24 Linux LPE exploits. In late July, a run with GPT-5.6 Sol found and exploited 166 unique LPEs for $513,690. The October run found 948, more than five times as many, despite three months of kernel hardening in between.

Others got here first on smaller scales. Google says its Big Sleep agent found its first real-world vulnerability by November 2024, and later a critical SQLite flaw. This year, The Verge reported that the Linux bug "Copy Fail" was found with help from an AI scanning tool. In July, Wired covered GhostLock, a 15-year-old kernel root bug found with an AI bug-hunting tool.

OpenAI also says its agents used at least 10 exploitation techniques that outside kernel experts had not seen before. It withheld the details for safety reasons. The report admits mistakes, too. In an early run, 20 of 200 "successful" exploits reached root through a different zero-day than the one assigned, so OpenAI added an independent check.

What should Linux admins do now?

Patch faster, and assume less. OpenAI's advice is blunt: a low-privileged account on a system that "isn't up-to-date on its latest available patches" should be considered "functionally equivalent to root access for a well-resourced threat actor."

For anyone running shared servers, CI runners or multi-user machines, that means two things. First, install kernel updates quickly and reboot into them. Second, do not rely on user accounts alone to keep code apart. OpenAI recommends defense in depth, with sandboxes and isolation layers such as Firecracker and gVisor to limit the damage from any one exploit.

The same tools work for defenders. OpenAI says its analyst agents followed a workflow similar to its Codex Security plugin. If you want AI help reviewing your own code, our list of AI security tools and our page on AI for code review are a good place to start.

O

OpenAI Codex

92

OpenAI's coding agent for the terminal, IDE, desktop and cloud sandboxes, included with ChatGPT plans or billed by API tokens.

🇺🇸United States·Added 21d ago

Freemium·from $8/mo·API

94trust score out of 100

S

Snyk

71

Developer security scanning for code and dependencies

🇬🇧United Kingdom·Added 2mo ago

Freemium·from $25/mo·API

90trust score out of 100

1

Our take

We checked every pipeline figure in this story against OpenAI's report, and the stage costs add up to the $1,213,430 total, give or take rounding. But this is one company grading its own work, and nobody outside OpenAI has confirmed the count of 948 Linux kernel exploits. Last week, Google also put cyber defense at the center of its Gemini 4 Carbon launch. The pattern is clear: frontier labs now treat bug finding as a core model skill, and Anthropic's work on formal verification of open-source libraries points the same way.

What to watch next

Watch three things. First, how many of the 948 candidate patches land upstream and in distribution kernels over the coming weeks. Second, whether kernel maintainers or independent researchers confirm OpenAI's count of Linux kernel exploits. Third, the name and release of the "upcoming cyber model" behind the run, and who gets access. On November 2, OpenAI also said it is preparing its next internal security sprint and has committed $1 billion in subsidized access for defenders over six months.