Table of Contents
OpenAI has built an autonomous security research pipeline that found, demonstrated, and generated candidate fixes for 948 distinct Linux kernel vulnerabilities capable of giving an ordinary local user root access. A mid-October run using an upcoming cyber model cost $1.21 million in API credits, or roughly $1,279 per distinct privilege-escalation vulnerability.
The system combines code analysis, testing in isolated virtual machines, exploitability assessment, and patch generation, with human security researchers reviewing the results before reporting them to Linux maintainers. OpenAI has already sent hundreds of reports and candidate patches for critical vulnerabilities and is coordinating further submissions with its Patch the Planet partners.
Linux underpins cloud infrastructure, Android devices, and supercomputers. Local privilege escalation, or LPE, lets someone who already has limited access to a machine cross the operating system’s permission boundary and gain administrative control. The research measures how AI agents can identify and prioritize those flaws across a large, widely used codebase.
From 2,308 Findings to 948 Distinct Vulnerabilities
The pipeline began by narrowing the search. Scout agents selected 5,034 security-relevant audit targets reachable by low-privileged users, covering about 2.8 million lines of code, roughly 7% of the Linux kernel. Analyst agents then examined those targets and produced 2,308 deduplicated candidate findings within 12 hours.
A separate validation stage attempted to reproduce each finding in an isolated virtual machine using Kernel Address Sanitizer, a tool that detects memory errors. Within 30 hours, the system reproduced 1,724 vulnerabilities, about 74.7% of the candidates.
OpenAI found that the remaining candidates largely involved elevated privileges or conditions that were difficult to reproduce within the available time. Incorrect model analysis accounted for 3.1% of the candidate findings; failure to reproduce a finding was not automatically counted as a false positive.
The next stage screened the validated findings for information disclosure and privilege escalation. Agents produced 291 information-leak proofs of concept and 1,169 working LPE exploits. OpenAI then examined related variants and developed 948 distinct patches for the vulnerabilities behind those exploits, using that count as its measure of unique LPE vulnerabilities.
The test machines ran a stock desktop Linux configuration with standard protections enabled, including SMEP, SMAP, kernel address-space randomization, and hardened user-copy checks. The results therefore did not depend on switching off those defenses.
Where the API Budget Went
OpenAI’s research report breaks down the cost of moving from source-code review to demonstrated security impact. Exploitability work consumed most of the API budget, while selecting the initial audit targets cost comparatively little.
| Stage | API Cost |
|---|---|
| Scout agents selecting audit targets | $3,426 |
| Analyst agents identifying candidate findings | $316,549 |
| Dynamic validation | $73,330 |
| Initial exploitability screening | $44,194 |
| Exploit development | $775,929 |
| Total Reported Run | $1,213,430 |
These are API-credit costs, not a complete accounting of researcher labor or computing infrastructure. OpenAI also says it prioritized methodology and capability measurement rather than cost optimization, leaving room to reduce spending through changes to the agents’ runtime and workflow.
To put the expense in context, OpenAI applied historical Linux LPE bounty amounts of $20,000 at Pwn2Own and $70,000 at TyphoonPWN to the 948 vulnerabilities. That produced a hypothetical valuation of $18.9 million to $66.3 million, approximately 16 to 55 times the pipeline’s API cost, rather than an actual bounty payout.
A separate 112-hour campaign tested an adapted version of Google’s kernelCTF environment, which uses a hardened kernel with a reduced attack surface. It produced 25 information-leak proofs of concept and 21 LPE exploits for roughly $32,936 in API credits. OpenAI removed the SLAB\_VIRTUAL mitigation because it was incompatible with the latest kernel used in the experiment. Because of that removal, these results are not directly comparable to the competition’s standard environment.
OpenAI estimated a roughly $1.5 million award if those 21 vulnerabilities were accepted by the program. At the time of its report, kernelCTF had accepted 26 confirmed zero-day LPE exploits during 2026.
Better Models Changed the Workflow
An earlier campaign in late July used GPT-5.6 Sol to find and exploit 166 unique LPE vulnerabilities for $513,690 in API credits. The October campaign produced more than five times as many with the newer cyber model. Both scanned the latest Linux kernel master branch available at the time, with three months of intervening development and security fixes.
OpenAI also examined how much specialized guidance the agents needed. Providing GPT-5.5 Cyber with a library of 103 exploitation techniques raised its success rate across 63 candidates from 76.2% to 88.9%. A more lightly orchestrated GPT-5.6 Cyber workflow outperformed that heavily scaffolded setup, and restoring the extra technique layer improved the newer model’s result by only 1.5 percentage points.
In a sample of 166 exploits, OpenAI identified 10 techniques that were new to its team and to the outside kernel experts it consulted. It withheld their full technical details for safety reasons.
Verification also required changes. In an early run, 20 of 200 reported LPE successes gained root through a different zero-day vulnerability than the one assigned to the agent. OpenAI tightened the task constraints and added an independent check that each final exploit used its assigned flaw. Obtaining administrative access alone was insufficient evidence that the original finding had been validated correctly.
Turning Findings Into Maintainer-Ready Fixes
Each completed research package includes a root-cause analysis, a minimal crashing proof of concept, a candidate patch, and a full exploit for human assessment. Researchers review those materials and the proposed severity before sending reports to maintainers.
Patch generation needed its own iteration. Initial fixes could stop the demonstrated exploit while adding unnecessary code, introducing potential performance tradeoffs, deviating from project conventions, or missing related variants. OpenAI refined the instructions and review process to address those issues, and in some cases used the prototype to identify problems in human-written patches before they were merged.
The kernel continued changing during the research. By the end of the 10-day scan and manual analysis, OpenAI observed that other contributors had already patched 61 LPEs upstream, prepared staging patches for 43, and publicly reported or discussed another 299. It recommends revalidating findings against current code before submission so maintainers receive actionable reports rather than duplicates or already-resolved issues.
OpenAI is working through its Patch the Planet initiative to submit the remaining reports and patches gradually, following the kernel community’s guidance to prioritize critical vulnerabilities.
