OpenAI says an unreleased cyber model built working exploits for 948 distinct Linux kernel flaws in a single run. The OpenAI Linux kernel scan took place in mid-October and cost $1,213,430 in API credits. Each exploit lets an ordinary local user take root, the highest level of control on a Linux machine.
The company described the work in a research post on Nov. 4.
The kernel runs Android phones, cloud infrastructure and supercomputers, so the findings reach far beyond desktop Linux. But the 948 figure needs care. It is OpenAI’s own count from one test, not a tally confirmed by kernel maintainers or a count of shipped fixes.
How 2,308 leads became 948 root exploits
OpenAI describes a five-stage pipeline. First, “scout” agents picked 5,034 audit targets that a low-privileged user can reach. That came to about 2.8 million lines of code, roughly 7% of a kernel with more than 40 million lines.
“Analyst” agents scanned those targets and produced 2,308 candidate findings within 12 hours. A triage agent then tried to trigger each one in an isolated virtual machine. Within 30 hours it reproduced 1,724, about 75%. OpenAI says only 3.1% of candidates reflected a wrong analysis by the model.
Next, exploit-writing agents attacked the validated bugs. Their targets ran what OpenAI calls a stock desktop operating system, with standard kernel defenses such as SMEP, SMAP and KASLR switched on. The agents produced 291 information-leak demos and 1,169 working root exploits.
Several exploits often traced back to one root cause. So OpenAI wrote 948 distinct patches and uses that number as its count of unique flaws. By our math, about 41% of the first-pass candidates ended as a distinct, working path to root.
The same pipeline running an earlier model, GPT-5.6 Sol, found 166 such flaws in late July for $513,690. The newer model found nearly six times as many, despite three months of kernel hardening in between. Other labs report similar jumps. Anthropic told investors this week that its AI may soon speed up its own research.
OpenAI writes the exploits inside its own lab
“Develops exploits” is OpenAI’s own description, and the post is direct about it. For each flaw, the pipeline hands a human a root-cause analysis, a crash demo, a candidate patch and “a full exploit”. OpenAI says the exploits help its researchers judge severity and get fixes accepted.
The runs took place in isolated virtual machines. A security researcher reviews each exploit, patch and severity rating before anything goes to maintainers.
The post also reports a failure that shows why that review matters. In an early run, the agents claimed 200 root exploits. Human reviewers found that 20 had reached root “through a different 0-day vulnerability than the one assigned”. OpenAI then added an independent check that each exploit uses the bug it was given.
The agents also used at least 10 exploitation techniques that were new to OpenAI and to outside kernel experts, the company says. That finding comes from a sample of 166 exploits. “For safety reasons, we omit sharing the full technical details,” the post says. OpenAI hasn’t published the exploits themselves.
The model has no public name. The post calls it “an upcoming cyber model” and gives no release date.
OpenAI offers its current cyber models through Daybreak, its security program, where it says it verifies applicants “and review[s] how they plan to use OpenAI’s models”. A “Daybreak Red” tier covers exploit validation and authorized red teaming. The post doesn’t say whether the new model will sit behind the same gate.
Maintainers were already fixing many of the same bugs
OpenAI is reporting the flaws in stages, starting with the critical ones at the kernel community’s suggestion. It says it has sent “hundreds of reports and patches” so far. Its Patch the Planet partners, Trail of Bits, Calif and HackerOne, will help send the rest.
The post lists no CVE numbers, the standard IDs for public security flaws. It also doesn’t say how many of its patches maintainers have accepted.
Other people were finding the same bugs. When the scan ended after 10 days, 61 of the flaws had upstream fixes and 43 more had fixes in staging, OpenAI says. It credits those fixes to other contributors.
Another 299 flaws were already under public discussion. By our count, that is 403 of the 948, about 43%, fixed, queued or public within 10 days.
That matches what kernel maintainers have said all year. In March, stable-kernel maintainer Greg Kroah-Hartman told The Register that AI security reports had gone from “AI slop” to useful. “Something happened a month ago, and the world switched. Now we have real reports,” he said. He added: “It’s more reviews; it’s more stuff we have to review for the kernel.”
We found no maintainer comment on this run itself. Coverage in The Hacker News, Help Net Security and Techzine relies on OpenAI’s post.
The $1.2 million bill and the bounty math
The full run worked out to $1,279 per exploit, OpenAI says. Writing exploits took most of the money, at $775,929. Finding the candidates cost $316,549. OpenAI calls these figures an upper bound, since it focused on capability rather than cost.
It then compares the bill with hacking-contest prizes. Pwn2Own and TyphoonPWN have historically offered $20,000 and $70,000 for a Linux kernel root exploit. At those rates, OpenAI puts a “hypothetical valuation” of $18.9 million to $66.3 million on the 948. That is 16 to 55 times the cost.
Treat that as a ceiling, not a price. It assumes every exploit would have won a prize, yet other people were already fixing or discussing about 43% of the flaws.
A smaller test is easier to check. Google’s kernelCTF runs a reward program on a hardened kernel. There, the pipeline produced 21 root exploits for about $32,936.
OpenAI notes that kernelCTF has accepted 26 confirmed zero-day root exploits from all entrants in 2026. It values its 21 at about $1.5 million if accepted, but doesn’t say whether it has submitted them.
What OpenAI’s findings mean for Linux machines now
The most practical line in the post is about updates. A low-privileged account on an unpatched system “should be considered functionally equivalent to root access for a well-resourced threat actor,” OpenAI writes.
These are local bugs, so an attacker first needs a foothold, such as a stolen login or a compromised app. The flaws decide how far that foothold goes. That makes prompt kernel updates on servers, shared machines and Android devices more urgent. OpenAI also recommends isolation tools such as Firecracker and gVisor to limit damage.
OpenAI chief executive Sam Altman made the broader case at Stanford last month, warning that the world can’t simply patch every bug. The PHP2Shell flaws that AI helped find in October showed the same race. OpenAI’s remaining Linux patches now go out through its Patch the Planet partners, and it plans to run the pipeline on other critical open-source projects.
Disclosure: BreezyScroll uses Anthropic’s Claude, a competitor of OpenAI, to help draft articles.
