OpenAI Says Its Agents Built Working Exploits for 948 Distinct Linux Kernel Root Flaws in One $1.21 Million Run

OpenAI says its agents found 948 distinct ways for an ordinary local user to become root on a Linux machine, proved each one with a working exploit, and drafted a patch for each underlying flaw. The company published the results on November 4, 2026 in a research post titled “A thousand fewer paths to root,” reporting a total cost of $1,213,430 in API credits for the mid October run.

Local privilege escalation, shortened to LPE, means a flaw that lets someone who already has a limited account on a machine raise that account to root, the account that controls the whole system. OpenAI counted an exploit as a success only when it produced a root shell. The target was not a weakened lab build: OpenAI says the test machines ran a stock desktop operating system with SMEP, SMAP, KASLR and HARDENED_USERCOPY switched on, the standard kernel protections a normal distribution ships.

The Announcement

The work came from OpenAI’s Cyber team as part of Patch the Planet, an initiative under its Daybreak programme that pairs model driven research with human review before anything reaches a maintainer. The pipeline has five stages: discovery, dynamic validation inside isolated virtual machines, exploitability assessment, patch generation, and human review of each exploit, patch and proposed severity rating.

Scout agents first marked out 5,034 audit targets covering about 2.8 million lines of code, roughly 7 percent of the kernel, chosen for reachability by low privileged users and for security relevance. Analyst agents then produced 2,308 candidate findings within 12 hours. Triage agents reproduced 1,724 of them, about 74.7 percent, within 30 hours. OpenAI says only 3.1 percent of the candidates rested on an impossible condition and counted as plain model error. The rest mostly needed higher privileges or failed to trigger inside the time budget.

Exploit development agents then worked on the strongest candidates and produced 291 proofs of concept for information leaks and 1,169 working LPE exploits. Variant analysis grouped exploits that traced back to the same flaw, and that grouping is where 948 comes from: 948 distinct vulnerabilities, each backed by a distinct candidate patch. Treat 948 as a count of distinct flaws with candidate patches, not as a count of fixes already shipped to anyone’s machine.

Important Details

The cost figures are OpenAI’s own accounting, and the company is candid that the total is more an upper bound than a tuned price. Exploitation was by far the most expensive stage, at $775,929 of the $1,213,430 total. A successful exploit cost an average of $359 in credits to develop, while failed attempts averaged far more, which is why OpenAI flags a clear give up rule as an obvious saving for future runs.

Two comparisons in the post need careful reading. OpenAI priced the 948 exploits against past contest payouts of $20,000 at Pwn2Own and $70,000 at TyphoonPWN, giving a hypothetical value of $18.9 million to $66.3 million. That is an illustration built from other people’s prize tables, not bounty income and not a market price. The second comparison is internal: a late July run using GPT-5.6 Sol found 166 distinct LPE flaws for $513,690, and a June run using GPT-5.5 Cyber produced 24. The jump from 166 to 948 in about three months is OpenAI’s central claim about model progress, and it rests on OpenAI’s own runs against the latest kernel master branch at each date.

In a sample of 166 exploits, OpenAI says the agents used at least 10 exploitation techniques that its researchers had not seen documented before, and that outside kernel exploitation experts consulted by the company also judged them new. OpenAI withheld the technical detail of those techniques for safety reasons, so that claim currently stands on the company’s account and on experts it chose not to name in the post.

The post also carries its own warning about trusting agent output. In an early run, the pipeline reported 200 successful exploits, and human review found that 20 of them had reached root through a different zero day flaw than the one assigned. OpenAI tightened the task and added an independent check that each final exploit uses its assigned vulnerability. That episode is the strongest argument in the whole report for keeping the human review stage exactly where it is.

1. June 2026GPT-5.5 Cyber produced 24 LPE exploits under Patch the Planet, as reported by OpenAI
2. Late July 2026A GPT-5.6 Sol run found and exploited 166 distinct LPE flaws for $513,690
3. Mid October 2026The run with the upcoming cyber model scanned the latest kernel and produced the 948 figure
4. November 4, 2026OpenAI published "A thousand fewer paths to root" with the full counts and costs

What Is Patched, and What Is Not

By the time the scan and the manual analysis finished, 10 days after the scan, OpenAI says 61 of the flaws had already been patched upstream, 43 had patches in staging, and 299 were being reported and discussed in public. OpenAI says it has already sent hundreds of reports and candidate patches for critical flaws, following guidance from the Linux kernel community, and is sending the rest gradually with Patch the Planet partners.

What the post does not contain matters for anyone running servers today. It names no CVE identifiers, no affected kernel versions and no subsystems, and the candidate patches become real fixes only when maintainers accept them. A separate test against Google’s kernelCTF programme, a hardened kernel with a reduced attack surface, produced 21 LPE exploits and 25 information leak proofs of concept over 112 hours for $32,936, which OpenAI presents as evidence the pipeline works against a harder target as well. That kernelCTF result is also reported, not independently confirmed.

Readers who follow agent research here will recognise the pattern from other recent work, such as DeepSeek’s agent prototype that picks up bugs in a repository: the agent output is only as useful as the checking wrapped around it.

What’s Next

The confirmed next steps are disclosure work, not new model releases. Reports and candidate patches keep flowing to maintainers through Patch the Planet partners, starting with the critical flaws, and each report still passes human review at OpenAI first. The open questions are plainer: how many of the 948 candidate patches survive maintainer review in something close to their drafted form, and whether the count changes as maintainers deduplicate reports against flaws found by other researchers in the same window.

Facts in this report were checked on November 5, 2026 against OpenAI’s research post and independent coverage of it. The deeper consequence is already visible in OpenAI’s own framing: if a pipeline can do this work for about $1,279 per distinct flaw, then leaving known software unpatched stops being a backlog problem and becomes an open door, for defenders who run the same tools and for anyone else who gets access to them.

Sources

• Primary report, all counts, stage costs, protections, techniques, kernelCTF test and patching status: A thousand fewer paths to root, OpenAI
• Independent coverage of the same report, including the maintainer status counts and the human review finding: OpenAI’s upcoming AI model built 948 working Linux root exploits in a single run, Help Net Security
• Body image: generated illustration in the Dirty Static house style, Dirty Static