OpenAI's pipeline found, validated, and patched 948 Linux kernel LPEs in one run — at ~$1,279 per exploit

OpenAI says an autonomous pipeline found, validated, and generated patches for 948 local privilege-escalation (LPE) vulnerabilities in the Linux kernel in a single run, at a reported API cost of $1.21M — roughly $1,279 per working exploit. The numbers are vendor-reported and unverified, but the mechanism and the economics are worth taking seriously.

What shipped

On November 4, OpenAI published "A thousand fewer paths to root," describing a five-stage agent pipeline run against the latest Linux kernel master branch in mid-October 2026. The stages, per OpenAI's post:

1. Discovery. Scout agents pick low-privilege-reachable, security-relevant targets — about 5,034 audit targets, roughly 2.8M lines, ~7% of the kernel. Analyst agents, using a workflow "similar to that of the Codex Security plugin," produce candidate findings.
2. Dynamic validation. Triage agents write a proof-of-concept and run it in an isolated VM with KASAN, iterating on output until the bug reproduces or the time budget runs out.
3. Exploitability assessment. A deliberately permissive screening agent narrows candidates, then ExploitDev agents test in VMs with standard protections — SMEP, SMAP, KASLR, HARDENED_USERCOPY — on a stock desktop OS, not a weakened target.
4. Patch generation. The model gets the relevant source plus patch-writing best practices and static checks.
5. Human review. An operator reviews exploit, patch, and severity before anything goes to maintainers.

The reported funnel: 2,308 candidate findings after deduplication, 1,724 dynamically reproduced (~74.7%), and 948 distinct LPE vulnerabilities after variant analysis, plus 291 info-leak PoCs. OpenAI says it generated a candidate patch for each of the 948 and has started sending reports and patches to kernel maintainers, beginning with critical bugs per kernel-community guidance.

OpenAI reports the run cost $1,213,430 in API credits — $1,279 per LPE exploit. At historical Pwn2Own ($20,000) and TyphoonPWN ($70,000) Linux-LPE bounty prices, the 948 exploits would be worth $18.9M–$66.3M, or 16x–55x the run cost (OpenAI, Cyber Security News). In a separate run on an adapted hardened kernelCTF environment, OpenAI reports producing 21 LPE exploits and 25 info-leak PoCs in ~112 hours at ~$32,936; it notes kernelCTF accepted 26 confirmed 0-day LPEs in all of 2026.

This continues earlier runs: GPT-5.5 Cyber produced 24 LPE exploits in June, and GPT-5.6 Sol found 166 unique LPEs in late July at $513,690 — meaning October's model found more than 5x as many, despite three months of hardening between the scans (SecurityWeek).

Why it matters

The real story is the flipped economics and the shifted bottleneck. OpenAI reports producing a working Linux root exploit for ~$1,279 of API credits — roughly 1/16th to 1/55th of what a single Pwn2Own or TyphoonPWN bounty historically paid. Systematic AI vulnerability discovery came in below bounty pricing, which means "finding the bugs" is becoming the solved part of the problem.

The new constraint is human-maintainer throughput. OpenAI reports observing 61 LPEs patched upstream and 43 with staging patches within 10 days while the scan ran, with ~299 reported or discussed publicly — though this counts ecosystem-wide activity, not solely OpenAI-authored merges. The pipeline author, answering questions on Hacker News, said that if compute permits, the plan is to re-scan the kernel with every newer generation of cyber models. A commenter on HN already pointed at the bottleneck: "you're probably bottlenecked on people to review these," and an OpenAI team member said on the thread that the team is hiring.

For security engineers, the practical takeaway is blunt. OpenAI's own guidance is to treat "a low-privileged account on an operating system that isn't up-to-date on its latest available patches" as "functionally equivalent to root access for a well-resourced threat actor." Patch and update velocity is the new defense, and sandboxing (Firecracker, gVisor) matters more than it used to. OpenAI also claims to have disclosed and patched issues in Kata, Moby/Docker, and gVisor.

Caveats

Every headline number here is a vendor claim. There is no third-party audit of the 948 figure, no published CVE list, no upstream commit list, no model card, and the exploit code and the 10 claimed novel exploitation techniques are withheld for safety — so outsiders cannot reproduce the result (explainx.ai). The $1.2M figure is in API credits, and OpenAI itself calls it "more an upper bound."

OpenAI's own reporting undercuts confidence in the raw counts. In an early run, the exploitation stage claimed 200 successful root exploits, but human review found 20 had reached root through a different zero-day than the one the agent was assigned — leading OpenAI to add an independent check that each exploit uses the assigned bug (Help Net Security). The 948 "distinct" count rests on OpenAI's own variant analysis, and skeptics on HN questioned how many are dead drivers and whether bounty programs would ever pay out.

The kernel community has long been skeptical of AI-reported bugs. Greg Kroah-Hartman's Kernel Recipes 2026 talk audited a similar AI report and found, of 79 claimed vulnerabilities, roughly 10 real fixes — with 24 lacking detail, 14 not bugs, 3 made-up data, and 15 already fixed — and he has banned LLM-generated patches from drivers/staging without hardware testing (sparsenotes.com). As of this writing, there is no kernel-maintainer response specific to the 948 claims.

Finally, the coverage is narrow by design: validation only accepted candidates that were low-privilege-reachable and produced memory-corruption evidence, so semantic/logic bugs and race conditions were deprioritized — exactly the class kernel developer Andy Lutomirski says the interesting bugs tend to fall into ("almost none were memory safety errors," he noted on HN). Treat the 948 as a lower bound on memory-safety LPEs, not a census of kernel bugs.

Sources

• OpenAI — A thousand fewer paths to root
• Help Net Security — OpenAI Linux kernel root exploits
• SecurityWeek — AI agents got root on Linux via 948 kernel flaws
• Cyber Security News — OpenAI uncovers 948 Linux kernel vulnerabilities
• explainx.ai — OpenAI Linux kernel 948 LPE exploits analysis
• Hacker News — pipeline author thread
• sparsenotes.com — Security in the LLM Age (Greg Kroah-Hartman)