948 local privilege-escalation exploits capable of gaining root: that is the result OpenAI attributes to a 30-hour run of its new automated pipeline on Linux. The company says the system reproduced 1,724 vulnerabilities, also generated proof-of-concept exploits for 291 information-disclosure flaws, and prepared patches for the identified issues. The total cost was $1,213,430 in API credits.
The figure describes both the leap in capability OpenAI wants to demonstrate and a more immediate security problem: finding flaws and producing exploits can be accelerated, but the defensive value depends on findings being validated, reaching maintainers, and turning into installed updates. The company says human researchers reviewed the results and that it has already sent reports and fixes. The numbers, however, come from OpenAI; there is no independent verification of the 948 cases.
From 2,308 candidates to 948 exploits
The test was conducted in mid-October using a cybersecurity model that has not yet been released. OpenAI describes a five-stage process: locating relevant code, reproducing findings in an isolated environment, assessing whether they could be exploited, proposing patches, and subjecting the results to human review.
According to data published by the company and detailed by IT之家, the agents selected 5,034 audit targets, covering around 2.8 million lines of code, close to 7% of the kernel. That analysis produced 2,308 candidates. The validation phase reproduced 1,724 of them, roughly three-quarters, in isolated virtual machines.
The subsequent assessment found 1,169 cases in which the agents achieved local privilege escalation, but the final count was 948 distinct vulnerabilities, after analyzing variants and working on patches. The distinction matters: these are not 948 initial reports or 948 untested candidates, but the final number OpenAI presents as distinct vulnerabilities with functional exploits.
The company says the exploits were tested on a desktop Linux distribution with common protections enabled, including SMEP, SMAP, KASLR, and HARDENED_USERCOPY. It did not publish the distribution’s name or the kernel version used. It also says the agents generated proof-of-concept exploits for 291 information-disclosure vulnerabilities.
The process turns code analysis into a chain of validation, exploitation, remediation, and review:
flowchart TD A["Seleccionar código"] --> B["Analizar candidatos"] B --> C["Validar en entorno aislado"] C --> D["Evaluar explotación"] D --> E["Proponer parches"] E --> F["Revisión humana"] F --> G["Informar a mantenedores"]
The cost per flaw is lower, but still high
According to OpenAI, the $1,213,430 total works out to around $1,279 per exploit. IT之家 attributes $775,900 to the exploit-development phase, the most expensive part of the process. The figure should not be read as a stable price per vulnerability: OpenAI acknowledges that it reflects the model, configuration, and workflow used in that test, and does not represent the lowest possible cost after optimizing agent coordination.
A comparison with an earlier run offers a measure of the change, though it is not a controlled experiment. In July, OpenAI used GPT-5.6 Sol and reported 166 local privilege-escalation vulnerabilities for $513,690. In October, with a different model and a revised pipeline, the result was more than five times higher, even though the kernel had received around three months of security hardening between the two tests.
The cost per result suggests automated analysis can increase the volume of research without requiring every finding to involve the same manual effort as a traditional audit. But the total cost of this run, which exceeded a million dollars, is also a caveat: this is not a free tool or an operation that any team can easily replicate. Moreover, a significant part of the work does not end when an exploit is generated. Duplicates must be ruled out, the flaw must be confirmed as real, its impact understood, and a fix developed without introducing other problems.
An offensive capability that can also help fix flaws
OpenAI maintains that its system did more than find flaws: it also proposed patches. IT之家 explains that early versions could be redundant, potentially affect performance, deviate from project conventions, or fail to cover variants of the same flaw. The company says it added constraints and repeated the process to improve quality; it adds that some generated patches helped identify problems in solutions previously written by human experts.
Human review is therefore part of the mechanism, not a formality that can be considered complete once the model produces an output. Researchers must assess the exploit, the proposed fix, and the severity before notifying maintainers. According to data released by OpenAI, during the ten days of analysis and review, 61 vulnerabilities had already been fixed in the upstream kernel, 43 had patches in preparation, and another 299 were under public discussion or in the process of being reported.
The number of fixes confirms that work is underway, but it does not mean that all vulnerabilities have been repaired or that systems running Linux are protected. An upstream patch must be integrated into distributions and products, and then installed on affected machines. OpenAI says it prioritized serious flaws in accordance with guidance from the kernel community and will send the remaining reports with Patch the Planet partners.
The company itself sums up the risk posed by out-of-date systems with a stark warning:
“For the near and medium term, having access to a low-privileged account on an operating system that isn't up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.”
— OpenAI
The leap does not eliminate questions about measurement
OpenAI says the agents used at least ten Linux exploitation techniques that were new to the team and to external specialists it consulted. Among them, The Hacker News lists methods for manipulating persistent kernel objects, improving exploit reliability, and achieving privilege escalation with data-only techniques. The company did not publish the full details for security reasons.
There is also a precedent that calls for careful interpretation of the figures. ArtificialWatch reports that, in an initial run, 20 of 200 reported successes reached the target through a vulnerability different from the one assigned. OpenAI says it fixed that problem by adding a check. This review improves the process, but it does not amount to an external audit of the final results.
The additional test in the hardened kernelCTF environment produced 21 local privilege-escalation exploits and 25 information-disclosure proof-of-concept exploits, at an approximate cost of $32,936 and over 112 hours, according to IT之家. Times of AI compares the 21 results with the 26 zero-day privilege-escalation exploits that kernelCTF reportedly accepted throughout 2026. The context differs from the analysis on a desktop distribution: that environment has a smaller attack surface and, according to ArtificialWatch, one mitigation unsupported by the latest kernel version was disabled.
Directly comparing results across tests can therefore exaggerate what the model itself can do. The target, environment, defenses, model version, and agent organization all vary. The model used in October is also not publicly known: OpenAI identifies it only as a cybersecurity model that is close to release.
What changes for maintainers and businesses
For software maintainers, the practical effect is not that they should automatically accept AI-generated patches, but that the volume of potential reports could grow quickly. If findings arrive faster, triage, reproduction, and coordinating fixes can become the bottleneck. OpenAI calls for automated detection to be matched by patch generation; the status of the published reports shows that this work involves collaborating with kernel maintainers and following their procedures.
Organizations deploying Linux face the other half of the problem: reducing the time between a fix becoming available and its installation. The UK National Cyber Security Centre, cited by The Hacker News, warned that AI defensive tools can shorten the period between the emergence of a zero-day flaw and its becoming a known vulnerability, but systems will remain exposed if the technology is not configured correctly and fixes are not rolled out. It also called for internal update and testing processes to be adapted to the new pace of discovery.
The warning has an offensive dimension. The same capabilities that help defenders can make it easier for others to find and prepare exploits. The Hacker News also reports that Google Threat Intelligence Group observed an increase from 5,045 disclosed vulnerabilities in January 2026 to 10,740 in August, while those classified as high risk rose from 131 to 350 during that period. These figures describe disclosures; they do not prove that AI caused them. The article itself links the change to a broader trend of faster vulnerability discovery.
OpenAI maintains that, in the medium term, models could find complex flaws and help exploit vulnerabilities that have already been disclosed. For businesses, October’s results make a low-privilege local account a more serious risk when a system is behind on patches. The immediate question is not when the model will be released, a date OpenAI has not announced, but how many of the outstanding reports will become installable fixes.
Sources: The Hacker News, IT之家, Times of AI, ArtificialWatch
