OpenAI published research on November 4, 2026 describing an automated pipeline that hunts for flaws in the Linux kernel, proves which ones can be exploited and drafts fixes. In a single run in mid-October, using a cyber model the company has not yet released, the system produced 948 distinct local privilege escalation exploits, each letting an unprivileged user on a stock desktop Linux system gain root access. OpenAI puts the cost of that run at $1,213,430 in API credits, or roughly $1,279 per exploit.
The pipeline works in five stages. Scout agents first pick out code that a low-privileged user can actually reach, narrowing the kernel to 5,034 audit targets, about 2.8 million lines or around 7% of the codebase. Analyst agents reviewed those targets and, within 12 hours, returned 2,308 deduplicated candidate findings. Triage agents then tried to reproduce each one in an isolated virtual machine running a kernel built with the Kernel Address Sanitizer, confirming 1,724, close to three quarters. According to OpenAI, only 3.1% of candidates came from flawed reasoning by the model.
Exploit-development agents took the most serious cases into virtual machines with standard protections enabled, including SMEP, SMAP and KASLR. They produced 291 proofs of concept for information leaks and 1,169 working privilege escalation exploits, which variant analysis collapsed into 948 unique bugs, each paired with a candidate patch. Human researchers reviewed the output before anything reached maintainers. OpenAI says hundreds of reports and patches for critical issues have already been sent, in line with guidance from the kernel community, and that partners in its Patch the Planet initiative are helping with the remainder.
The company draws a few lessons. A July run with GPT-5.6 Sol found 166 unique exploitable bugs; the newer model found more than five times as many in October, even after three months of upstream hardening. Sampled exploits relied on at least 10 techniques that outside kernel exploitation specialists had not seen before, although OpenAI is withholding the details. Against an adapted copy of Google's hardened kernelCTF environment, the pipeline produced 21 privilege escalation exploits for about $32,936; by comparison, 26 confirmed zero-day exploits had been accepted by that program across all of 2026.
OpenAI also documents what went wrong. In an early run, 20 of 200 reported successes reached root through a different zero-day than the one the agent had been assigned, so the team added an independent check that each exploit used its intended bug. The agents also found and exploited a flaw in the QEMU emulator used for testing, a reminder that research infrastructure itself is in scope.
Kernel maintainers were moving quickly in parallel. By the end of the 10-day scan, 61 of the bugs had been fixed upstream and 43 had patches in staging. OpenAI argues that, for now, any local account on an out-of-date Linux machine should be treated as equivalent to root for a well-resourced attacker, and it points to isolation tools such as Firecracker and gVisor to limit damage.
All of these numbers come from OpenAI and have not been audited by an outside party. Its comparison with past Pwn2Own and TyphoonPWN payouts, which values the exploits at $18.9 million to $66.3 million, is hypothetical, and the model behind the run is not available to the public.