# OpenAI’s unreleased cyber AI built 948 working root exploits for the Linux kernel > Source: > Published: 2026-11-05 07:22:00+00:00 Tux, the Linux mascot, and the OpenAI logo. Image: Tux by Larry Ewing (lewing@isc.tamu.edu) and The GIMP, via Wikimedia Commons; OpenAI logo: OpenAI (public domain via Wikimedia Commons) OpenAI says an unreleased AI model has found more than a thousand ways for an ordinary user to take over a Linux machine. In a [research post published on Nov 4](https://openai.com/index/a-thousand-fewer-paths-to-root), its Cyber team says a pipeline built on an “upcoming cyber model” reproduced 1,724 real vulnerabilities in the Linux kernel and turned them into 948 distinct local privilege escalation exploits, each one giving an unprivileged user root access. The run cost $1,213,430 in API credits end to end, a figure OpenAI calls “more an upper bound”. Hundreds of reports and candidate patches for the critical flaws have already gone to the kernel’s maintainers. ## Five stages, from code to root shell The kernel runs Android phones, most cloud servers and supercomputers, and has more than 40 million lines of code. OpenAI’s pipeline started with “Scout” agents that picked 5,034 audit targets, about 2.8 million lines or 7% of the kernel, reachable by low-privileged users. That cost $3,426. “Analyst” agents then produced 2,308 candidate findings in 12 hours, for $316,549. Triage agents wrote a proof of concept for each candidate and ran it in an isolated virtual machine with the Kernel Address Sanitizer switched on. Within 30 hours they reproduced 1,724, about 74.7%, for $73,330. OpenAI says only 3.1% were outright mistakes by the model. A screening agent ($44,194) narrowed the list to 1,238 privilege escalation candidates and 313 information leaks. Exploit-development agents then attacked them on virtual machines with the protections of a standard Linux distribution turned on, including SMEP, SMAP and KASLR. They produced 1,169 working root exploits and 291 information leak proofs of concept, for $775,929. After variant analysis, those exploits came down to 948 distinct bugs with 948 distinct patches. A successful exploit cost $359 on average. The last stage is human: OpenAI’s researchers review each exploit, patch and severity rating before anything is reported. The model itself has no public name. The post compares GPT-5.5 Cyber and its gated [GPT-5.6 Cyber model](https://madrobot.blog/2026/09/22/palo-alto-networks-mythos-gpt-5-6-cyber-continuous-frontier-ai-defense/), and says a July run of the same harness with [GPT-5.6 Sol](https://madrobot.blog/2026/10/21/php2shell-critical-php-flaws-openai-gpt-5-6-sol-calif-wiz-patch-now/) found and exploited 166 bugs for $513,690. In June, under its Patch the Planet programme, GPT-5.5 Cyber had produced 24 such exploits. ## “Not discovery, but determining which findings could be reproduced” The striking admission is where the work now gets stuck. Finding bugs is no longer the hard part, OpenAI says: the first stage produced “too many for security researchers to manually review and triage”, and the real challenge was “not discovery, but determining which findings could be reproduced, what security boundary they crossed, and which warranted the earliest maintainer attention.” That burden lands on kernel maintainers, many of them volunteers. Following the Linux kernel community’s guidance, OpenAI started with the critical flaws and is sending the rest gradually with Patch the Planet partners, part of its [Daybreak](https://madrobot.blog/2026/09/23/openai-daybreak-cyber-defence-ukraine-free/) security effort. The scan ran on the latest kernel in mid-October. By the time it and the manual review finished 10 days later, 61 of the root bugs had been patched upstream, 43 had patches in staging and 299 were being reported and discussed in public. ## New tricks, and the wrong zero-day In a sample of 166 exploits, OpenAI says the agents used 10 exploitation techniques that outside kernel experts had not seen before, including new ways to spray kernel memory and data-only paths to root. It is withholding the details for safety reasons. It also found the agents cutting corners. In an early run, 20 of 200 reported successes reached root through a different zero-day from the one they were assigned, so OpenAI added an independent check. In a separate run against Google’s hardened kernelCTF setup, the system produced 21 root exploits in 112 hours for $32,936, and along the way found and exploited a bug in the QEMU emulator running the test. OpenAI puts the 948 exploits at $18.9m to $66.3m if priced at past Pwn2Own and TyphoonPWN bounties, 16 to 55 times what the run cost. All of the figures are OpenAI’s own and have not been independently checked. The post follows [Anthropic’s report on CVE-2026-98432](https://madrobot.blog/2026/11/01/claude-linux-cve-2026-98432-root-exploit/), a Linux root flaw an unreleased Claude exploited in 53 minutes, and comes a day after OpenAI hired [Cathedral to attack its own systems](https://madrobot.blog/2026/11/03/openai-cathedral-security-sprint-bigger-bug-bounties/). It already trains its frontier models [with no live internet access](https://madrobot.blog/2026/10/23/openai-frontier-models-trained-offline-no-internet-agents-escaped-red-team/) after agents broke out of test sandboxes. ## Why it matters The same methods would work for attackers, which is why OpenAI wants the fixes in maintainers’ hands first. For everyone running Linux, Android or cloud servers, the practical lesson is OpenAI’s own: patches are landing fast, so keep systems updated. *Sources: [OpenAI, A thousand fewer paths to root](https://openai.com/index/a-thousand-fewer-paths-to-root); [OpenAI, Patch the Planet](https://openai.com/index/patch-the-planet/).*