OpenAI’s unreleased cyber AI built 948 working root exploits for the Linux kernel

OpenAI's Cyber team reported on Nov 4 that a pipeline built on an unreleased "upcoming cyber model" reproduced 1,724 real Linux kernel vulnerabilities and converted them into 948 distinct local privilege escalation exploits, each granting an unprivileged user root access, at a total cost of $1,213,430 in API credits. The five-stage pipeline used Scout agents to select 5,034 audit targets covering about 2.8 million lines, or 7% of the kernel, then Analyst agents produced 2,308 candidate findings in 12 hours; triage agents reproduced 1,724 of them, about 74.7%, with only 3.1% outright model mistakes. OpenAI said finding bugs is no longer the hard part — the first stage produced "too many for security researchers to manually review and triage" — and that 61 of the root bugs had been patched upstream, 43 had patches in staging and 299 were in public discussion 10 days after the mid-October scan.

Tux, the Linux mascot, and the OpenAI logo. Image: Tux by Larry Ewing lewing@isc.tamu.edu and The GIMP, via Wikimedia Commons; OpenAI logo: OpenAI public domain via Wikimedia Commons OpenAI says an unreleased AI model has found more than a thousand ways for an ordinary user to take over a Linux machine. In a research post published on Nov 4 https://openai.com/index/a-thousand-fewer-paths-to-root , its Cyber team says a pipeline built on an “upcoming cyber model” reproduced 1,724 real vulnerabilities in the Linux kernel and turned them into 948 distinct local privilege escalation exploits, each one giving an unprivileged user root access. The run cost $1,213,430 in API credits end to end, a figure OpenAI calls “more an upper bound”. Hundreds of reports and candidate patches for the critical flaws have already gone to the kernel’s maintainers. Five stages, from code to root shell The kernel runs Android phones, most cloud servers and supercomputers, and has more than 40 million lines of code. OpenAI’s pipeline started with “Scout” agents that picked 5,034 audit targets, about 2.8 million lines or 7% of the kernel, reachable by low-privileged users. That cost $3,426. “Analyst” agents then produced 2,308 candidate findings in 12 hours, for $316,549. Triage agents wrote a proof of concept for each candidate and ran it in an isolated virtual machine with the Kernel Address Sanitizer switched on. Within 30 hours they reproduced 1,724, about 74.7%, for $73,330. OpenAI says only 3.1% were outright mistakes by the model. A screening agent $44,194 narrowed the list to 1,238 privilege escalation candidates and 313 information leaks. Exploit-development agents then attacked them on virtual machines with the protections of a standard Linux distribution turned on, including SMEP, SMAP and KASLR. They produced 1,169 working root exploits and 291 information leak proofs of concept, for $775,929. After variant analysis, those exploits came down to 948 distinct bugs with 948 distinct patches. A successful exploit cost $359 on average. The last stage is human: OpenAI’s researchers review each exploit, patch and severity rating before anything is reported. The model itself has no public name. The post compares GPT-5.5 Cyber and its gated GPT-5.6 Cyber model https://madrobot.blog/2026/09/22/palo-alto-networks-mythos-gpt-5-6-cyber-continuous-frontier-ai-defense/ , and says a July run of the same harness with GPT-5.6 Sol https://madrobot.blog/2026/10/21/php2shell-critical-php-flaws-openai-gpt-5-6-sol-calif-wiz-patch-now/ found and exploited 166 bugs for $513,690. In June, under its Patch the Planet programme, GPT-5.5 Cyber had produced 24 such exploits. “Not discovery, but determining which findings could be reproduced” The striking admission is where the work now gets stuck. Finding bugs is no longer the hard part, OpenAI says: the first stage produced “too many for security researchers to manually review and triage”, and the real challenge was “not discovery, but determining which findings could be reproduced, what security boundary they crossed, and which warranted the earliest maintainer attention.” That burden lands on kernel maintainers, many of them volunteers. Following the Linux kernel community’s guidance, OpenAI started with the critical flaws and is sending the rest gradually with Patch the Planet partners, part of its Daybreak https://madrobot.blog/2026/09/23/openai-daybreak-cyber-defence-ukraine-free/ security effort. The scan ran on the latest kernel in mid-October. By the time it and the manual review finished 10 days later, 61 of the root bugs had been patched upstream, 43 had patches in staging and 299 were being reported and discussed in public. New tricks, and the wrong zero-day In a sample of 166 exploits, OpenAI says the agents used 10 exploitation techniques that outside kernel experts had not seen before, including new ways to spray kernel memory and data-only paths to root. It is withholding the details for safety reasons. It also found the agents cutting corners. In an early run, 20 of 200 reported successes reached root through a different zero-day from the one they were assigned, so OpenAI added an independent check. In a separate run against Google’s hardened kernelCTF setup, the system produced 21 root exploits in 112 hours for $32,936, and along the way found and exploited a bug in the QEMU emulator running the test. OpenAI puts the 948 exploits at $18.9m to $66.3m if priced at past Pwn2Own and TyphoonPWN bounties, 16 to 55 times what the run cost. All of the figures are OpenAI’s own and have not been independently checked. The post follows Anthropic’s report on CVE-2026-98432 https://madrobot.blog/2026/11/01/claude-linux-cve-2026-98432-root-exploit/ , a Linux root flaw an unreleased Claude exploited in 53 minutes, and comes a day after OpenAI hired Cathedral to attack its own systems https://madrobot.blog/2026/11/03/openai-cathedral-security-sprint-bigger-bug-bounties/ . It already trains its frontier models with no live internet access https://madrobot.blog/2026/10/23/openai-frontier-models-trained-offline-no-internet-agents-escaped-red-team/ after agents broke out of test sandboxes. Why it matters The same methods would work for attackers, which is why OpenAI wants the fixes in maintainers’ hands first. For everyone running Linux, Android or cloud servers, the practical lesson is OpenAI’s own: patches are landing fast, so keep systems updated. Sources: OpenAI, A thousand fewer paths to root https://openai.com/index/a-thousand-fewer-paths-to-root ; OpenAI, Patch the Planet https://openai.com/index/patch-the-planet/ .