OpenAI Says Unreleased Model Found 948 Linux Kernel Flaws It Could Exploit for Root Access

The company described the exercise in a research post titled "A thousand fewer paths to root". According to the post, as reported by Help Net Security and SecurityWeek, the pipeline produced 1,169 working local privilege escalation exploits and 291 information-leak proofs of concept against the latest kernel code. It tested them on virtual machines running an unmodified desktop distribution with standard protections such as KASLR, SMEP and SMAP switched on. Grouping the exploits by the flaw behind them gave 948 distinct bugs, each with its own patch. The run used $1,213,430 in API credits, or about $1,279 per exploit.

For companies that run Linux servers, the result raises the stakes of any break-in. Privilege escalation bugs do not let an attacker in from outside, but they turn a low-level account into full control. OpenAI wrote that a low-privileged account on an unpatched system "should be considered functionally equivalent to root access for a well-resourced threat actor."

How the Agents Worked

Groups of agents split the job into scoping, bug discovery, triage and exploit development. They first narrowed the kernel down to the roughly 7% of its code that low-privileged users can reach, then flagged 2,308 possible bugs within 12 hours. The triage stage reproduced 1,724 of them, or 74.7%, in isolated virtual machines over 30 hours. The scan and the manual analysis that followed took 10 days in total.

OpenAI said the agents used at least 10 exploitation techniques that outside kernel exploitation experts had not seen before. It has withheld the technical details for safety reasons. The results rest on the company's own figures, and no independent researcher has yet published a check of them.

The company also described a failure. In an earlier run, the exploitation stage claimed 200 root exploits, but 20 of them reached root through a different zero-day from the one they were assigned. OpenAI added an independent check that each exploit uses its intended bug and wrote that "even successful exploitation by agents needs proper validation." Security researchers review every exploit, patch and proposed severity rating before anything is sent to maintainers.

An earlier scan in July, using a model called GPT-5.6 Sol, produced 166 unique privilege escalation exploits for $513,690, according to SecurityWeek.

Pricing the Output

OpenAI also ran the pipeline against an adapted version of Google's kernelCTF, a hardened kernel with a smaller attack surface. Over 112 hours and $32,936 in API credits, it produced 21 privilege escalation exploits and 25 information-leak proofs of concept. Google's programme accepted 26 confirmed zero-day privilege escalation exploits in 2026. OpenAI estimates its 21 would have earned about $1.5 million and says the pipeline "was net profitable at the time of this research."

The company also put a value on the October results. Pwn2Own and TyphoonPWN have paid $20,000 and $70,000 respectively for a Linux kernel privilege escalation exploit, and at those rates OpenAI values the output at between $18.9 million and $66.3 million. Both figures are OpenAI's estimates, not money that was paid.

OpenAI has not released the model used in the run. It gives approved organisations access to its cybersecurity models through its Daybreak programme. It recommends layered defences: keeping systems up to date and isolating workloads with sandboxing tools such as Firecracker and gVisor.

Fixing the flaws will take longer than finding them did. On the kernel community's advice, OpenAI said it has submitted hundreds of reports and patches, starting with the most serious flaws, and will send the rest in stages through partners in its Patch the Planet initiative. At the time of the post, 61 of the privilege escalation bugs had been patched upstream, 43 had patches in staging and 299 were being reported and discussed publicly.