- OpenAI says one AI research run produced 948 working Linux root exploits for about $1.2 million in API costs, so finding flaws is getting cheaper.
- OpenAI says that for a well-resourced attacker, a low-privilege account on an unpatched system should be treated as "functionally equivalent" to root access.
- Ask how fast your team applies Linux patches, where low-privilege users run code, and how any AI testing vendor verifies its results.
The scarce skill is no longer finding the bug
A Linux root exploit used to be a craft product. One researcher, one flaw, a long investigation. OpenAI now describes the same work as a production line. It says research that once needed a separate effort for each finding "can increasingly be run as a systematic process."
The lesson here is that discovery is getting cheap, and judgment is getting scarce. A leader's question shifts from "do we have unknown bugs?" to "how fast do we apply fixes?"
What OpenAI reported
OpenAI ran a prototype in a controlled research environment in mid-October 2026. It used an upcoming cyber model that is not publicly available. The pipeline analysed 2,308 candidate findings in the Linux kernel. It reproduced 1,724 vulnerabilities. It produced 948 working local privilege escalation exploits.
A local privilege escalation lets someone with a low-level account become root. Root means full control of the machine. The target was a stock desktop operating system of a commonly used Linux distribution. It was not a weakened setup.
OpenAI paid $1,213,430 in API fees for the run. It prices that at $1,279 for each exploit. These are OpenAI's own figures, from its own model. The sources include no independent check.
How the pipeline works
The pipeline has five stages. First, "Scout" agents picked 5,034 audit targets. That is about 2.8 million lines of code, roughly 7% of the kernel. Skipping the rest kept the cost down. This stage cost $3,426.
Next, analyst agents read those targets. In 12 hours they produced 2,308 candidate findings. That stage cost $316,549. A candidate is only a suspicion, and code review often raises false alarms.
So a triage agent wrote a test program for each candidate. It ran the program in a virtual machine with the Kernel Address Sanitizer, a tool that flags memory corruption. In 30 hours the system reproduced 1,724 vulnerabilities, about 74.7% of candidates. Few candidates were plain mistakes. OpenAI puts that share at 3.1%, where the model's report relied on a situation that could not occur.
Exploit agents then tried to turn the flaws into root access. The test machines kept on the protections a standard distribution enables. These included SMEP, SMAP, KASLR and HARDENED_USERCOPY, which make memory attacks harder. OpenAI says this avoided unrealistic results.
The agents produced 1,169 working exploits. After variant analysis, OpenAI counted 948 distinct vulnerabilities, each with a candidate patch. The exploit stage cost $775,929, the largest share of the total. Human researchers reviewed the results before anything went to maintainers.
What the price comparison says
OpenAI applied historical contest bounties to its output. It cites $20,000 from Pwn2Own and $70,000 from TyphoonPWN for Linux kernel exploits. For 948 exploits, that gives a hypothetical $18.9 million to $66.3 million. OpenAI calls that 16x to 55x its cost. Nobody paid those sums.
OpenAI also tested a kernelCTF environment. It is a hardened kernel with fewer attack surfaces. There the pipeline produced 21 exploits in 112 hours, for about $32,936. OpenAI dropped one kernelCTF protection, SLAB_VIRTUAL, because it did not work with the kernel version tested. OpenAI also says its costs are "more an upper bound."
Where the risk sits now
In an early run, the exploit stage reported 200 successes. Human review found that 20 of them reached root through a different zero-day than the assigned one. OpenAI's takeaway is to verify the path to a result, not only the result.
Patching moved fast too. When the 10-day scan and manual analysis ended, OpenAI observed 61 Linux local privilege escalations patched upstream and 43 with staging patches, many from other contributors. It says 299 more were being discussed publicly. OpenAI does not tie these counts to its own 948. It also says it has sent hundreds of reports and patches to maintainers.
OpenAI draws a clear line for operators. In the near and medium term, a low-privilege account on an unpatched system should count as "functionally equivalent" to root access for a well-resourced attacker. The UK's National Cyber Security Centre, quoted by The Hacker News, says organisations must evolve their patching and testing processes to match this pace.
Questions to put to your team
Start with speed. How many days pass between a Linux patch release and its rollout to servers, laptops, containers and cloud images? If nobody measures it, that is the first gap.
Then look at exposure. Which systems let low-privilege users or untrusted code run, such as shared build servers or developer machines? OpenAI points to sandboxes and isolation tools like Firecracker and gVisor to limit the damage.
Next, ask about repeat testing. OpenAI says its October model found more than five times as many novel local privilege escalations as a July run with GPT-5.6 Sol. Three months of hardening came in between. Its advice is to rescan code when models improve.
Finally, if you buy AI security testing, ask how the vendor confirms an exploit used the intended flaw. Ask what stops a costly attempt that is going nowhere.
The bug hunt now has a factory. The patch queue is still run by people, and that is where the risk will be decided.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: OpenAI.
