OpenAI Says AI Pipeline Found and Exploited 948 Linux Kernel Privilege-Escalation Flaws

The company described the work in a research post published on Wednesday. Local privilege-escalation bugs let a user or program with limited access on a machine take full control of it, known as gaining root. The Linux kernel runs most of the world's servers, cloud infrastructure and Android phones, so a large batch of such flaws found at once puts heavy pressure on the volunteers and companies who maintain it. OpenAI's own conclusion is that finding bugs is no longer the hard part. "Vulnerability discovery is becoming easier to scale, but prioritization and validation remain operational bottlenecks," the researchers wrote.

Five Stages From Scan to Patch

The prototype works in five stages: discovery, dynamic validation, exploitability assessment, patch generation and human review. In the October run, a first "scout" pass picked out 5,034 audit targets covering about 2.8 million lines of code, roughly 7 per cent of the kernel. Analyst agents then produced 2,308 candidate findings after removing duplicates, within 12 hours. The system reproduced 1,724 of them, about 74.7 per cent, in a test environment within 30 hours.

After screening, the agents produced 291 proof-of-concept exploits for information leaks and 1,169 working privilege-escalation exploits. OpenAI says it counted unique vulnerabilities by the number of distinct patches generated, which came to 948. Successful exploits cost about $359 each on average, and the company said only 3.1 per cent of candidates turned out to rest on incorrect analysis by the model.

The October campaign followed two smaller ones. In June, GPT-5.5 Cyber developed 24 privilege-escalation exploits as part of OpenAI's Patch the Planet programme for open-source maintainers. A late-July run found and exploited 166 unique flaws for $513,690 in API credits. OpenAI said its newer model needed less scaffolding than its predecessor: "Stronger models require lighter orchestration and hand-holding," the post says.

Patches and the Maintainers' Queue

OpenAI says it followed guidance from the Linux kernel community and started by reporting the most critical issues, and that hundreds of reports and patches have already gone to maintainers. It is working with Patch the Planet partners to submit the rest gradually. Ten days into the effort, maintainers had patched 61 of the privilege-escalation flaws upstream, 43 had patches in staging, and 299 were being reported and discussed in public, according to the company.

The post sets out several limits. Validation only covered bugs reachable by low-privileged users without special capabilities that produced clear evidence of memory corruption, so race conditions and bugs with unusual triggers were often left unreproduced. Exploits were tested against standard distribution protections such as SMEP, SMAP and KASLR. OpenAI calls its cost figures an upper bound, because the team was measuring capability rather than trying to cut spending, and it warns that findings go stale quickly as the kernel changes. The company has not said what share of its generated patches maintainers have accepted unchanged.

OpenAI also tried to put the results in market terms. Pricing the 948 exploits at historical bounties from the Pwn2Own and TyphoonPWN contests gives a hypothetical value of $18.9 million to $66.3 million, roughly 16 to 55 times what the run cost. The agents used 10 exploitation techniques that the team and outside experts considered new, and OpenAI is withholding the details for safety reasons. The work also turned up flaws in the test setup itself, including a QEMU bug, and issues the company says it has disclosed and patched in Kata, Moby/Docker and gVisor.

OpenAI says it will keep reporting the remaining kernel findings, extend the approach to other critical open-source projects through its Daybreak initiative, rescan audited code as models improve, and use models to review both human-written and AI-generated patches.