On November 4, 2026, OpenAI said an AI system had found 948 distinct flaws in the Linux kernel that let an ordinary local user take full control of a machine. The kernel, as OpenAI notes, is the core of the operating system behind Android phones, cloud infrastructure and supercomputers. An earlier scan, run in late July with an older OpenAI model, had found 166.
The system is built around an upcoming cybersecurity model that OpenAI has not released. For each flaw, it wrote a working exploit, code that proves the flaw can be used, and drafted a candidate patch, a proposed fix. The mid-October scan cost $1,213,430 in API credits, priced at OpenAI’s pay-per-use rates, or $1,279 per flaw, according to OpenAI’s write-up.
All 948 are of one type, called local privilege escalation. The attacker must already be on the machine, with an ordinary account or code running under one, and can then become “root”, the administrator with every right. OpenAI says the tests ran in isolated virtual machines (simulated computers) inside a controlled research environment.
How 5,034 targets became 948 flaws
OpenAI’s pipeline has five stages: four run by AI agents, then human review. The scan and manual analysis took 10 days. Scout agents picked 5,034 parts of the kernel worth auditing, about 2.8 million lines or roughly 7% of its code, for $3,426. Analyst agents then read those parts and flagged 2,308 candidate findings in 12 hours, for $316,549.
A triage agent tried to reproduce each candidate on a test kernel built to detect memory errors. Within 30 hours it confirmed 1,724, about 75%. Most of the rest needed extra privileges to begin with or did not reproduce in time. OpenAI says only 3.1% reflected a wrong analysis by the model.
Exploit agents then worked on 1,238 promising root-access candidates and 313 information-leak candidates, bugs that expose kernel memory that should stay hidden. They ran in virtual machines with an off-the-shelf desktop version of Linux and its standard protections on. They produced 1,169 working root exploits and 291 proofs of concept, or working demonstrations, for information leaks.
OpenAI grouped the exploits by underlying bug and wrote 948 distinct patches. That number is its own count of unique flaws. At the exploit stage alone, a successful exploit cost $359 on average. Failed attempts cost far more, $3,922 each across 69 cases, which OpenAI blames on a few hard-to-exploit bugs such as race conditions, flaws that depend on exact timing.
Human researchers reviewed the results before anything reached the kernel’s maintainers, the developers who decide which changes go in. OpenAI says it has “already sent out hundreds of reports and patches for critical vulnerabilities.” The rest are going out gradually, it adds, with partners of Patch the Planet, its program for open-source projects.
From 166 flaws in July to 948 in October
OpenAI’s June count used an earlier, different setup and does not compare with the later two. At the launch of Patch the Planet with the security firm Trail of Bits, OpenAI reported 24 root exploits by GPT-5.5 Cyber, an OpenAI security model. Those were the subset of hundreds of issues for which a proof was generated automatically.
The July and October scans, which OpenAI compares directly, both targeted the kernel’s master branch, its latest development version at the time. In late July, while the pipeline was still being built, OpenAI’s GPT-5.6 Sol model found and exploited 166 unique root flaws for $513,690 end to end.
In mid-October, the newer model found and exploited 948 for $1,213,430: 5.7 times the flaws for 2.4 times the money. It did so despite what OpenAI calls “three months of hardening between the scans,” meaning security fixes to the kernel in between. The cost per flaw fell from about $3,100 to $1,279. OpenAI’s lesson for defenders: “Rescan previously audited code as model capabilities improve.”
OpenAI also says its stronger cyber model needed less help. With GPT-5.5 Cyber, a library of 103 known exploitation techniques raised the agent’s success rate on 63 candidates from 76.2% to 88.9%. GPT-5.6 Cyber, the next version, beat that score without the library. Adding the library back gained only 1.5 percentage points, so the team dropped it.
In a sample of 166 exploits, OpenAI also counted 10 exploitation techniques new to its researchers and to outside kernel experts it consulted. It withholds the full technical details “for safety reasons.”
Anthropic took a different approach to defense. On October 22, it reported that its model Claude wrote machine-checked no-crash proofs across 123 open-source libraries, proofs that code never crashes on any input up to a set size.
Costs compared with bug bounty prizes
OpenAI set its costs against the prizes security competitions pay for the same kind of exploit. Google’s kernelCTF program, which rewards working exploits against a Linux kernel with extra protections, now pays a single fixed reward of $71,337 per eligible exploit. The TyphoonPWN 2026 hacking contest lists up to $70,000 for a Linux privilege escalation.
OpenAI also ran its pipeline in an adapted kernelCTF environment, a kernel with a reduced attack surface (fewer parts an attacker can reach). It used the latest kernel and dropped one kernelCTF protection that did not work with it. In 112 hours and for about $32,936, it produced 21 root exploits and 25 information-leak proofs.
By the time OpenAI wrote its post, kernelCTF had accepted 26 confirmed root exploits for previously unknown flaws in 2026. If the program accepted all 21, OpenAI puts the award at around $1.5 million, about 45 times the cost. Under kernelCTF’s rules, only the first submission for a vulnerability is eligible for a reward.
For the main run’s 948 flaws, OpenAI applies past prizes: $20,000 per flaw at the Pwn2Own hacking contest, by its account, and $70,000 at TyphoonPWN. That gives $18.9 million to $66.3 million, 16 to 55 times the run’s cost. “Based on public pay-out amounts,” the post says, the pipeline “was net profitable at the time of this research.” OpenAI calls that valuation hypothetical and its reported costs “more an upper bound,” since better engineering around the model could lower them.
What the post does not show
Every figure about the runs comes from OpenAI’s own research write-up, which cites no outside audit. The post lists problems of its own. In an early run, the exploit stage reported 200 successes, but human reviewers found that 20 got root through a different flaw than the one assigned. OpenAI then added an independent check.
First-draft patches sometimes added more code than needed, could hurt performance, broke local coding conventions or missed variants of the same bug. They improved only with more instructions and revisions.
Maintainers carry part of the cost. In June, OpenAI wrote that frontier models, the most advanced AI systems, “produce a high volume of false positives,” or bogus bug reports, “that can contribute to the already overwhelming backlog maintainers are facing.” That is why Trail of Bits engineers reviewed every finding by hand.
When OpenAI’s scan and analysis ended, other contributors had already patched 61 root flaws upstream, in the official kernel source. They also had patches for 43 more in staging, waiting to be merged. Another 299 were being reported and discussed in public.
OpenAI advises rechecking findings against the latest code to avoid duplicate reports. The post does not say how many of its own patches have been merged.
Access stays restricted: the model behind the run is unreleased. The same day, OpenAI extended GPT-5.6 Cyber, a separate model it already offers to approved defenders, to government teams in AWS GovCloud, Amazon’s cloud for US government work. The access runs through its Daybreak Red program, “for authorized vulnerability research, exploit validation, and security testing,” with stronger identity checks. Google took a similar route with its own model on October 28, when it offered Gemini 4 Carbon first to a subset of cyber defenders.
What it means
On OpenAI’s numbers, finding and exploiting a root flaw in the Linux kernel cost $1,279 on average in the October run, far below the $71,337 that kernelCTF pays for a single eligible exploit. Between the July and October scans the count rose 5.7 times, a gain OpenAI credits to the newer model despite three months of kernel hardening.
OpenAI writes that discovery “is becoming easier to scale, but prioritization and validation remain operational bottlenecks,” meaning ranking bugs and confirming them.
Other specialist code work is speeding up too. In October, the hub for fan projects that rebuild video game source code said it is winding down because AI models sped the work up.
For the near and medium term, OpenAI writes, a low-privileged account on a system that is behind on its patches “should be considered functionally equivalent to root access for a well-resourced threat actor.”
The next numbers to watch are how many of the 948 patches kernel maintainers merge, and how fast. Three other questions remain open: when OpenAI releases the model behind the run, and to whom; whether kernelCTF starts receiving AI-found exploits at this pace; and whether other labs publish comparable runs with their costs.
Sources
- A thousand fewer paths to root, OpenAI, November 4, 2026
- Patch the Planet: a Daybreak initiative to support open source maintainers, OpenAI, June 22, 2026
- Expanding Daybreak as the Cyber Defense Window Narrows, OpenAI, August 10, 2026
- Daybreak Red is now available in AWS GovCloud (US-East), OpenAI, November 4, 2026
- kernelCTF rules, Google, rules in force since September 4, 2026
- TyphoonPWN 2026, TyphoonCon, September 10, 2025
Header image: chart by MACCUS, data from OpenAI (November 4, 2026) and Google’s kernelCTF rules
