On Wednesday, November 4, OpenAI reported that an AI research pipeline had reproduced 1,724 real vulnerabilities in the Linux kernel and built working exploits covering 948 distinct flaws — each one a flaw that could let an unprivileged local user gain root access. The same pipeline wrote a candidate patch for every one of the 948 flaws, and hundreds of reports and patches for the most critical findings have already gone to Linux kernel maintainers. By the time OpenAI published its report, 61 of the flaws had already been patched upstream.
The Linux kernel is the software underneath Android phones, cloud servers, and supercomputers — systems used by billions of people. The finding matters for two reasons: the flaws are real and are being fixed now, and the pipeline that found them works at a scale no human security team can match. OpenAI’s report, titled “A thousand fewer paths to root”, describes a prototype, not a product — and every figure in it comes from OpenAI’s own account of a controlled experiment, not from independent testing.
The numbers: 2,308 candidates, 1,724 reproduced, 948 root flaws
OpenAI’s pipeline started with 2,308 candidate findings and narrowed them through testing. The funnel, as OpenAI reports it:
| Stage | Result reported by OpenAI |
|---|---|
| Candidate findings | 2,308 |
| Vulnerabilities dynamically reproduced | 1,724 (74.7% of candidates) |
| Working local privilege escalation exploits | 1,169 |
| Distinct privilege escalation flaws (after variant analysis) | 948 |
| Information-leak proofs of concept | 291 |
| Distinct candidate patches written | 948 |
The 948 figure needs a precise reading. The pipeline first produced 1,169 working exploits, then grouped them by underlying flaw: several exploits can target the same vulnerability. The 948 is the count of distinct flaws, each with its own candidate patch. It is not a count of fixes already merged into the kernel — only 61 had been patched upstream when the report was written, with 43 more having patches in staging and 299 publicly reported and discussed.
A candidate finding is not the same as a real vulnerability, and OpenAI’s report is explicit about that. Only 3.1% of the candidates turned out to be incorrect analysis by the model; most of the rest either needed elevated privileges to trigger or could not be reproduced within the time budget because of race conditions or specific trigger requirements.
How the pipeline works
The prototype has five stages. Scout agents pick the parts of the kernel worth auditing — 5,034 audit targets covering about 2.8 million lines of code, roughly 7% of a kernel with more than 40 million lines. Analyst agents then scan those targets for candidate flaws. Triage agents try to reproduce each candidate in an isolated virtual machine, building a proof of concept until it crashes the kernel or exhausts the ways to trigger it. Exploit-development agents then test whether a confirmed flaw can be turned into information disclosure or a root exploit. Finally, the system generates a candidate patch, and human researchers review the exploit, the patch, and the proposed severity before anything is reported to maintainers.
The whole October run was carried out in a controlled research environment, on a stock desktop operating system with the kernel protections a normal distribution ships — SMEP, SMAP, KASLR, and HARDENED_USERCOPY all switched on. That matters: the exploits were not demonstrated against a weakened target. The pipeline is powered by what OpenAI calls an “upcoming cyber model,” which it does not name.
The October run cost $1,213,430 in API credits, according to OpenAI — about $1,280 per distinct flaw found. The company says the figure is more an upper bound than a tuned price, since the work focused on measuring capability rather than cost. The most expensive stage was exploit development, at $775,929; discovery cost $316,549, validation $73,330, screening $44,194, and the initial scouting just $3,426.
What happened to the flaws
OpenAI says it has already sent hundreds of reports and patches for critical vulnerabilities to maintainers, following the Linux kernel community’s guidance to start with the most severe findings, and is working with its Patch the Planet partners on the rest. The scan ran against the latest kernel in mid-October 2026; by the time the scan and manual analysis finished ten days later, 61 of the flaws had already been patched upstream, 43 had staging patches, and 299 were being reported and discussed in public.
That speed is itself part of the story. Maintainers were fixing these flaws while OpenAI was still analysing them — which also means the pipeline has to re-check its findings against the latest code, or it risks reporting flaws that no longer exist.
The candidate patches are exactly that: candidates for maintainer review. They become real fixes only when maintainers accept them. OpenAI’s report says its patch generation improved with iteration — early patches were sometimes functionally correct but bloated, deviated from nearby code conventions, or missed variants of the same flaw — and that in a few cases the pipeline spotted problems in patches written by human experts, which were fixed before merging.
Why it matters: the jump since July, and the economics
This was not OpenAI’s first run at the kernel. In June, as part of its Patch the Planet initiative, the company said its GPT-5.5 Cyber model had identified kernel vulnerabilities and built 24 local privilege escalation exploits. In late July, a run with GPT-5.6 Sol found and exploited 166 unique privilege escalation flaws for $513,690. The October run found 948 — nearly six times as many — despite three months of additional hardening of the kernel between the scans.
OpenAI also puts a price on the other side of the equation. Historically, the Pwn2Own and TyphoonPWN competitions have paid $20,000 and $70,000 respectively for Linux kernel privilege escalation exploits. Applied to the 948 flaws, that produces a hypothetical valuation of $18.9 million to $66.3 million — 16 to 55 times what the run cost. That is a hypothetical comparison, not a payout: it assumes every finding would qualify for those rewards, which it would not. But it makes the economic point OpenAI wants to make — that finding flaws with AI is now far cheaper than the rewards the same flaws would once have commanded.
The pipeline also turned up things its builders did not expect. In a sample of 166 exploits, the agents used 10 exploitation techniques that OpenAI says were new to its third-party kernel exploitation experts; the technical details are withheld for safety. In a separate test against Google’s kernelCTF hardened kernel, the pipeline produced 21 privilege escalation exploits and 25 information-leak proofs of concept in 112 hours for about $32,936. And while testing, it accidentally found and exploited a vulnerability in QEMU’s test infrastructure itself — a flaw already fixed upstream, but a reminder that the tools used for offensive research need securing too.
What it doesn’t prove
Several limits deserve the same prominence as the headline numbers. First, all of the figures are OpenAI’s own account of its own experiment; the findings have not been independently tested, and the exploits themselves have not been published publicly. Second, the report names no CVE identifiers, no affected kernel versions, and no subsystems — so nobody can yet check whether a specific system they run is affected. Third, the scan covered about 7% of the kernel, not the whole codebase; the 948 flaws are what the pipeline found in the parts it audited.
Fourth, the pipeline itself is not infallible. During an early run, 20 of 200 exploits it reported as successful had achieved root access through a different vulnerability than the one they were assigned. Human review caught the error, and OpenAI tightened the task constraints and added an independent check — but it is a useful warning that even a successful exploit needs its path verified, not just its result.
And the dual-use question is unavoidable. The same pipeline that writes patches for defenders could, in other hands, find flaws for attackers. OpenAI’s stated aim is to make exploitation cost-prohibitive by helping defenders find and fix flaws first, and to extend the work to more critical open-source projects through Patch the Planet. Whether defenders stay ahead is an open question — the report itself notes that stronger models find more flaws, and that previously audited code is worth rescanning as models improve.
What readers should do and watch
For anyone running Linux systems — which includes most servers, Android devices, and cloud infrastructure — the practical step is the unglamorous one: keep systems updated. OpenAI’s own takeaway is that the rapid patching cycle “emphasizes the criticality for users and companies to keep software up to date.” OpenAI puts it bluntly: “For the near and medium term, having access to a low-privileged account on an operating system, that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.” The flaws found in this run are being fixed upstream; they only protect users who actually install the updates.
What to watch next: whether CVE identifiers are assigned to these findings, how many of the 948 candidate patches maintainers accept, and whether other organisations publish independent reproductions. The count that matters in the end is not how many flaws an AI found, but how many got fixed.
