OpenAI Taught AI Agents to Find 948 Paths to Linux Root for $1.2 Million

Consider a typical scenario: an attacker breaks into one web application on your server and gets an ordinary account with no special privileges. If the Linux kernel on that machine is not updated, a single local privilege escalation (LPE) vulnerability turns that account into root, a full administrator who can do anything. OpenAI has shown that such flaws can now be found, verified and turned into working exploits in a stream rather than one at a time. In a single run, its pipeline, built on an upcoming cyber model, confirmed 1724 kernel vulnerabilities and produced 948 exploits that give an ordinary user root. The API calls cost $1 213 430, or about $1279 per exploit.

How the pipeline works

Previously, each kernel finding was a separate investigation that took days. Now the work is split into five stages: discovery, dynamic verification, exploitability assessment, patch generation and human review. In June, as part of the Patch the Planet initiative, OpenAI reported that GPT-5.5 Cyber had found kernel vulnerabilities and written 24 exploits. That work has now been turned into a full pipeline.

First, scout agents went through the kernel's directories and files and picked those reachable by a low-privileged user. That produced 5034 targets, about 2.8 million lines, or roughly 7% of the kernel code. This stage cost $3426. Then analyst agents spent 12 hours producing 2308 vulnerability candidates after deduplication, at a cost of $316 549.

But a candidate is not yet a vulnerability. A verifier agent wrote code that triggers a crash and ran it in an isolated virtual machine with a kernel that has the KASAN memory debugger enabled. It examined the program's output and the system console, and refined the code until the bug reproduced. Over 30 hours, 1724 cases were confirmed, or 74.7%. Most of the rest required elevated privileges or failed to reproduce within the allotted time because of complex thread races and rare triggering conditions. Only 3.1% turned out to be errors in the model's analysis, where the vulnerability assumed an impossible condition. Verification cost $73 330.

For each finding, the system outputs a root-cause analysis, minimal crash code, a candidate patch and a full exploit. The result of the run in mid-October 2026: 291 information leaks and 948 working LPE exploits. The target was a standard desktop OS, not a weakened system.

What it costs and what it means

OpenAI compared the result with contest prizes. Pwn2Own and TyphoonPWN have previously paid $20 thousand and $70 thousand for such a Linux kernel exploit. For 948 findings, that comes to a hypothetical $18.9–66.3 million, 16 to 55 times the pipeline's cost.

On the cut-down kernel version from the kernelCTF competition, the pipeline produced 25 leaks and 21 exploits for $32 936. For comparison, in 2026 the program accepted 26 confirmed 0-day LPEs. Had it accepted these 21 as well, the reward would have been about $1.5 million, roughly 45 times the cost of the scan. In addition, the agents used at least 10 new kernel exploitation techniques.

The authors stress that they measured the model's capabilities, not price, so the figures cited are more of an upper bound. In their view, proper tuning of the scaffolding will noticeably cut the cost of each stage.

What to do in practice

The most important takeaway for administrators: in the coming years, for a strong attacker, access to a low-privileged account on a system without the latest patches is equivalent to root. So apply updates quickly, and treat sandboxes and isolation such as Firecracker and gVisor as mandatory protection that limits the damage from an exploited vulnerability.

The second takeaway concerns the models. In October, the new cyber model found more than 5 times as many new LPEs as the GPT-5.6 Sol run in July, even though the kernel had been hardened over those three months. This means large projects will have to be scanned and fixed over several rounds, repeated with each generation of models, for both closed-source and open-source code.

The community is not standing still either: during the 10 days the scan ran, more than 100 Linux LPEs were already fixed or had draft patches from other contributors, and about 300 more were being discussed publicly. OpenAI follows the kernel community's guidelines, starts with critical vulnerabilities, and is preparing further reports and patches together with its Patch the Planet partners.

The authors believe automated patch generation is necessary to close flaws at the pace they are found. With an expert involved, such patches can be correct, match the project's style and withstand attack variants. This is a research prototype with mandatory human review, but the direction is clear: finding vulnerabilities is becoming easier than triaging and fixing them.