THE ESSENTIALS IN 30 SECONDS

  • In a mid-October run, OpenAI's pipeline produced 2,308 candidate kernel findings, reproduced 1,724 and wrote exploits for 948 distinct local privilege-escalation flaws.
  • The run cost about $1.21 million in API credits, roughly $1,279 per flaw; a July run with GPT-5.6 Sol found 166 such flaws for $513,690.
  • OpenAI says hundreds of reports and candidate patches have gone to maintainers, but the 948 figure does not mean the bugs are fixed upstream.

OpenAI has published the results of a research run in which a chain of AI agents searched the Linux kernel for local privilege-escalation (LPE) bugs, the kind that let an ordinary user account take full root control of a machine. In a post titled "A thousand fewer paths to root", the company says the system, built around an upcoming cyber-focused model it has not named, ended up with working exploits for 948 distinct vulnerabilities, according to reports by The Hacker News, Unite.AI and Interesting Engineering.

How the pipeline works

The process runs in five stages. Scout agents first picked 5,034 audit targets, about 2.8 million lines or roughly 7% of the kernel, chosen because they are reachable by unprivileged users and relevant to security. Analyst agents then produced 2,308 deduplicated candidate findings within 12 hours. A validation stage reproduced 1,724 of them in isolated virtual machines within 30 hours. Further agents wrote proof-of-concept exploits and candidate patches, and human researchers reviewed each exploit, fix and proposed severity before anything was reported to maintainers.

Alongside 291 information-leak demonstrations, the run produced 1,169 working LPE exploits, which OpenAI counts as 948 unique flaws. The company says at least ten of the exploitation techniques were new to its researchers and to outside kernel experts it consulted; details are being withheld.

Cost and comparison

OpenAI puts the cost at about $1.21 million in API credits, or roughly $1,279 per flaw, and describes the figures as upper bounds. A comparison run in late July using GPT-5.6 Sol found 166 unique LPE flaws for $513,690. The new run found more than five times as many, even though the kernel had received three months of further hardening in between. The work extends a June release in which OpenAI reported 24 LPE exploits found with its GPT-5.5 Cyber model.

What remains open

The 948 figure is not a count of shipped fixes. OpenAI says it has sent hundreds of reports and patches for critical bugs to kernel maintainers and will pass on the rest gradually with partners in its Patch the Planet effort, while maintainers keep control over what is merged and disclosed. The company argues that patching must keep pace with AI-driven discovery. The affected distribution and the model have not been named, and the results have not been independently replicated.