OpenAI's unreleased cyber model found 948 Linux kernel root bugs in one $1.2 million run

OpenAI says an automated pipeline built around “an upcoming cyber model” ran against the Linux kernel in mid-October and, in OpenAI’s words, “validated and generated patches for 948 local privilege escalation vulnerabilities in Linux at an API cost of $1.2 million.” Local privilege escalation (LPE) means an unprivileged user on the machine can become root. OpenAI does not name the model, and it is not available to use.

What 948 counts

The number comes out of a funnel, all figures OpenAI’s:

• 2,308 candidate findings after deduplication, from agents that scanned 5,034 audit targets, about 2.8 million lines or roughly 7% of the kernel.
• 1,724 vulnerabilities reproduced in isolated virtual machines with the Kernel Address Sanitizer, about 74.7% of candidates. OpenAI says only 3.1% reflected incorrect analysis by the model.
• 1,169 working LPE exploits and 291 information leak proofs of concept, built against VMs with the protections “enabled by a standard Linux distribution,” including SMEP, SMAP and KASLR.
• 948 distinct patches after variant analysis. “We use that number to determine the overall number of unique LPEs,” OpenAI writes.

So 948 is OpenAI’s count of unique LPE vulnerabilities, not exploits. The targets ran “a stock desktop operating system” from what OpenAI calls “a commonly used Linux distribution,” which it does not name. The scan used the latest kernel master branch at the time.

The full run cost $1,213,430 in API credits, or $1,279 per LPE exploit by OpenAI’s math. For comparison, a July run with GPT-5.6 Sol found and exploited 166 unique LPEs for $513,690. OpenAI also says the agents used 10 exploitation techniques that were new to it and to outside kernel experts, and it withholds their details “for safety reasons.”

Patches and disclosure

The patches are candidates. OpenAI says it “developed candidate patches for maintainer review,” and that following the kernel community’s guidance it has “already sent out hundreds of reports and patches for critical vulnerabilities,” with the rest going out gradually through Patch the Planet partners. It does not say how many of its own patches have been merged.

It does describe a fast-moving upstream: when the scan and manual analysis finished after 10 days, 61 LPEs had been patched upstream, 43 had staging patches and 299 were being reported and discussed publicly. OpenAI’s summary credits those patches to “other contributors.”

Caveats OpenAI raises itself

• In an early run, 20 of 200 reported root exploits had reached root through a different zero-day than the one assigned. OpenAI then added an independent check that each exploit used its own bug.
• On an adapted version of Google’s kernelCTF, a hardened kernel with less attack surface, the pipeline produced 21 LPE exploits and 25 information leaks for about $32,936. OpenAI compares that with 26 confirmed zero-day LPEs accepted by kernelCTF so far in 2026.
• Its bounty math is hypothetical: applying past Pwn2Own and TyphoonPWN prices to the 948 unique LPEs gives $18.9 million to $66.3 million. That is a valuation, not a payout.
• During the kernelCTF run, the pipeline also found and exploited a QEMU TCG bug that was fixed upstream but not in the release build OpenAI used.

Why this matters

OpenAI’s own advice is blunt: for now, a low-privileged account on a system that is behind on patches “should be considered functionally equivalent to root access for a well-resourced threat actor,” and it points to isolation such as Firecracker and gVisor to limit damage. If you run shared Linux hosts, CI runners or agent sandboxes, that means fast kernel updates and not relying on user separation alone. OpenAI’s $1,279 per LPE exploit sits close to the roughly $1,000 per Firefox version that Epoch AI reported for turning public fixes into exploits, and the run follows Anthropic’s Claude-built exploit chains, which also came from an unreleased model. The remaining reports go out gradually through Patch the Planet, the program behind OpenAI’s Brotli disclosure, so watch your distribution’s kernel advisories.