OpenAI discloses AI pipeline that generated 948 Linux kernel exploits

On November 4, 2026, OpenAI disclosed a prototype cyber-focused AI pipeline after a run in mid-October 2026 that produced 948 working exploits that achieve local privilege escalation in the Linux kernel.

The November 4 disclosure is a development in OpenAI’s published work on autonomous vulnerability research, following a run that concluded in mid-October 2026. OpenAI framed the work as automated vulnerability validation and patching rather than weaponization.

Scout agents covered 5,034 targets while narrowing the audit to roughly 2.8 million lines of code, about 7 percent of the Linux kernel. Within 12 hours, analyst agents produced 2,308 candidate findings. During the mid-October 2026 run, the pipeline processed 2,308 candidate findings for the Linux kernel.

Triage agents reproduced 1,724 candidate findings out of 2,308 during the 30-hour run, a 74.7 percent reproduction rate, in isolated virtual machines. Agents dynamically reproduced 1,724 vulnerabilities in total during the run. The validation happened inside isolated virtual machines before any exploit was built. The 30-hour duration covered discovery, validation, and exploit generation stages.

Exploit-development agents produced 1,169 working root exploits before variant analysis cut the count to 948 distinct vulnerabilities. The pipeline additionally produced 291 proofs of concept for information leak vulnerabilities. The process collapsed exploit variants into a single count for each distinct vulnerability.

“The total run cost $1,213,430 in API credits, or $1,279 per LPE exploit,” OpenAI said of the mid-October 2026 run.

OpenAI said at least 10 novel Linux exploitation techniques appeared in the agents’ output. The novel set included two new persistent elastic objects for spraying objects inside the target kernel cache, two new page grooming techniques intended to make exploits more reliable, five new data-only techniques for gaining privilege escalation directly or through an arbitrary write, and one technique involving arbitrary type confusion. OpenAI said the techniques were new to third-party kernel exploitation experts as well.

Local privilege escalation lets a limited user gain root or administrative control over a system. These exploits could allow an unprivileged local user to gain root privileges. Attackers need an initial local foothold because they cannot exploit these vulnerabilities remotely without access to the device.

OpenAI said a well-resourced threat actor with an unprivileged local account on an unpatched operating system has functional root access in the near and medium term. More than 40 million lines of code make up the Linux kernel, which supports Android devices, cloud systems, supercomputers, and platforms used by billions of people. OpenAI has not publicly identified by name the upcoming cyber model that powered the pipeline.

Before any finding reaches Linux kernel maintainers, security researchers review each exploit and patch along with the proposed severity rating. A five-stage sequence runs from vulnerability discovery through dynamic validation and exploitability assessment to patch generation, with human review at the close.

After ten days of post-scan review, OpenAI counted 61 upstream patches, 43 staging patches, and 299 issues under public report or discussion. OpenAI has submitted hundreds of reports and patches to maintainers, giving priority to the most serious flaws as the Linux kernel community suggested.

OpenAI is working with Patch the Planet partners to report and address remaining issues. It plans to extend this research to other critical software projects via Patch the Planet.

The research appeared in a November 4 report titled “A thousand fewer paths to root.” The report did not include a full remediation breakdown covering every one of the 948 findings. For safety reasons, OpenAI kept technical details of the exploitation techniques out of its public post.

OpenAI tightened task rules and added an independent check confirming that each exploit targets its assigned vulnerability. The change came after an early run where human review showed 20 of 200 supposedly successful exploits gained root through a zero-day flaw other than the assigned one.

After generation, a patch needs maintainer review, testing, merging, and distribution before administrators can depend on it. The report does not provide a single emergency update covering all 948 findings. OpenAI said some first-draft patches included unneeded code changes or performance costs, while others failed to fix related variants of the same flaw.

OpenAI said automated patch generation must keep pace with how quickly frontier models find vulnerabilities so software stays secure and the exploitation window shrinks. OpenAI said AI-generated patches can become functionally correct, style-aligned, and resistant to attack variants through human expert-guided iteration. OpenAI said the pipeline’s hard part is deciding which flaws can be reproduced, what security boundary they cross, and which deserve maintainer attention first, rather than finding flaws.

GPT-5.6 Sol found 166 unique local privilege escalation vulnerabilities in July 2026 at a cost of $513,690. GPT-5.5-Cyber yielded 24 local privilege escalation exploits in June 2026. The October run turned up more than five times as many unique vulnerabilities as the July run, even after three months of further Linux kernel hardening.

A separate kernelCTF test lasted 112 hours and cost about $32,936 in API credits, during which the system created 21 privilege escalation exploits and 25 information leak demonstrations. kernelCTF accepted 26 confirmed zero-day privilege escalation exploits during 2026. OpenAI estimated the 21 kernelCTF exploits would bring in about $1.5 million if accepted and said its pipeline generated a net profit during the research period.

OpenAI put the hypothetical value of the 948 exploits at between $18.9 million and $66.3 million based on historical bounty rewards, or 16 to 55 times the pipeline’s cost. Pwn2Own and TyphoonPWN historically paid $20,000 and $70,000 respectively for Linux kernel privilege escalation exploits. OpenAI said the comparison does not prove that every finding would earn those rewards and is not a record of real bounty payments.

VulnCheck described AI-assisted vulnerability discovery as a growing risk category that lets inexperienced hackers find software flaws with almost no technical skill. Google Threat Intelligence Group reported that monthly vulnerability disclosures more than doubled from 5,045 in January 2026 to 10,740 in August 2026. Google Threat Intelligence Group reported that high-risk vulnerability disclosures rose from 131 in January 2026 to 350 in August 2026, a 167 percent increase.

In an assessment published Tuesday, the U.K. National Cyber Security Centre said AI-powered cyber tools have almost certainly driven a significant rise in zero-day vulnerability discovery. The centre said defensive AI-cyber tools reduced the window from zero-day to N-day and made patching quicker, but many systems remain vulnerable without correct and widespread configuring. Organizations need to update their internal patching and testing processes to keep up with the faster pace of vulnerability discovery, the National Cyber Security Centre said.

Sakshi Grover, research director at IDC, said the greater concern is the time between vulnerability discovery and fixes reaching production rather than the exploit count itself. Sakshi Grover said an upstream patch does not ensure that the fix is present in the Linux distribution kernel used by an enterprise.

Enterprises evaluating autonomous security tools should require reproducible exploits, correct root-cause identification, and independent validation, Yash Kadakia, founder and CTO at Security Brigade, said. Thomas Di Giacomo, chief technology and product officer at SUSE, said the use of AI to speed up code analysis and bug hunting represents a fundamental change in the threat landscape.

SUSE said it uses comparable AI tools to find and fix vulnerabilities. The company works with upstream communities on disclosure and patching.