# 948 Linux root bugs in one run: what OpenAI's $1.2 million pipeline actually proved > Source: > Published: 2026-11-10 11:30:29+00:00 If you run Linux hosts, shared jump boxes, or CI runners, the number that should stick is 948, not the sticker price. In one mid October run, an unreleased OpenAI cyber model produced 948 distinct local privilege escalation bugs in the Linux kernel, each with a path to root, for a total API bill of $1,213,430. That is about $1,280 per vulnerability. Olivia Hartman laid out the funnel, the cost comparison, and the limits of the claim in [a detailed look at OpenAI's mid October Linux kernel pipeline](https://geekblog.net/ai-software/openai-948-linux-kernel-root-exploits-pipeline-cost/). This is not a story about a chatbot writing a clever proof of concept. The pipeline was built to finish the job. It first narrowed the kernel to code that an unprivileged local user can actually reach. Agents then analyzed candidate flaws, tried to trigger them in virtual machines, and turned confirmed crashes toward root access. The test machines ran an unmodified desktop Linux setup with common protections switched on, including KASLR, SMEP, and SMAP, the usual defenses that make kernel exploitation harder. The funnel is worth reading slowly. The run started with 2,308 candidate findings. 1,724 were reproduced as real vulnerabilities. 1,169 became working root exploits. After grouping cases that pointed at the same underlying flaw, OpenAI counted 948 distinct vulnerabilities. Roughly 41 percent of the original suspects ended up as a unique, exploitable root bug. If you quote the exploit count and the bug count as if they were the same, you overstate how many separate problems landed in the kernel. The cost comparison is what made the announcement travel. Contests such as Pwn2Own and TyphoonPWN have paid roughly $20,000 to $70,000 for a Linux kernel privilege escalation exploit. At those rates, 948 bugs would be worth somewhere between about $19 million and $66 million, or 16 to 55 times what the run cost. One outlet also reports that an earlier OpenAI model found 166 unique root flaws for about $513,690 in late July, or close to $3,100 per bug. Treat the July comparison as indicative, because it comes from a single report. It would be easy to turn this into a claim that AI can now root any Linux machine for pocket change. That is not what was shown. These are local privilege escalation bugs, not remote ones. An attacker needs a foothold on the machine first. The flaws can turn a small compromise into a total one, but they do not open the front door. Part of the testing used an adapted version of Google's kernelCTF, a hardened kernel with a reduced attack surface. On that environment the pipeline reportedly produced 25 information leak proofs of concept and 21 privilege escalation exploits. The main run used a single unmodified desktop distribution. Other kernels, builds, and cloud images may behave differently. The 948 figure counts vulnerabilities, not merged fixes. The patches the pipeline generates are candidates that maintainers still have to review. And OpenAI has not named the model. It only calls it an upcoming cyber model, so nobody outside the company can reproduce the results yet. Dumping nearly a thousand root bugs on volunteer maintainers would be its own kind of problem, so the disclosure plan matters. OpenAI says human security engineers review exploits, patches, and severity before anything is sent. It started with the most severe cases, following advice from the kernel community, and has already sent hundreds of reports with patches attached. The rest are meant to go out gradually with partners in a program it calls Patch the Planet. Coverage of the announcement says maintainers had already patched 61 of the flaws by the time OpenAI finished its analysis, with another 43 sitting in staging. Exact counts differ slightly between outlets, so treat those figures as a snapshot. If you operate Linux systems, the practical response is still the right one. Apply kernel updates over the coming weeks, because a wave of patches is on the way. Limit who can run code locally on shared servers, because these bugs need a foothold first. Keep containers and CI runners on current kernels, since they often share a host kernel with everything else on that host. Turn on automatic security updates where your distribution supports them. The same capability cuts both ways. If a company can fund a bill of $1.2 million to find and fix bugs, a well resourced attacker can fund a run to hoard them. The hopeful reading is that a pipeline that writes the exploit also drafts the fix, and if maintainers can absorb that flow, the kernel could end the year with a thousand fewer paths to root. The cautious reading is that review capacity, not discovery, is now the bottleneck. Watch whether OpenAI names the model, how quickly distributions ship the fixes, and whether other labs publish comparable numbers.