Reported 4 Nov 2026 · Security A one-minute read

OpenAI says its own pipeline built 948 working Linux root exploits.

OpenAI published the run on November 4 and reported $1,213,430 of API credits. Caveat: the exploits target a Linux distribution OpenAI does not name.

Until now

Finding kernel flaws at scale needs scarce human experts.

Now

A model does it unattended, at about $1,279 a flaw.

Why it matters

The number that matters is not 948, it is $1,279. At that price a well-funded group can buy a thousand routes to root for the cost of one engineer's year. OpenAI says it reviews everything before disclosure, and that 61 fixes have landed. The fixing side has no comparable pipeline.

Established

OpenAI reports 948 working privilege escalation exploits from one pipeline run.
It reports $1,213,430 of credits spent, about $1,279 a flaw.
It reports 61 fixes merged upstream 10 days after the scan.

Not established

That the exploits are loose. OpenAI says nothing leaves without human review.
Which distribution. OpenAI does not name the system it targeted.
That attackers can match this. No outside group has shown the same run.

The five-minute readThe record, the timeline, the weight and 4 sources

The record

Reported, not verified: openai.com returned a client error on every attempt from here, so we could not read the post itself. The account rests on The Hacker News and AI Weekly, which quote it directly and agree on the counts, the cost and the method. Dated test: if the post at openai.com/index/a-thousand-fewer-paths-to-root becomes readable, or OpenAI repeats the figures in a filing or conference talk, by December 5, 2026, we upgrade or correct.

OpenAI published the write-up on Wednesday November 4, 2026. The run itself was in mid-October 2026 and used an unnamed upcoming cyber model. As reported, scout agents narrowed a kernel of more than 40 million lines to 5,034 audit targets, about 2.8 million lines or roughly 7% of the code. Analyst agents then produced 2,308 deduplicated candidate findings in 12 hours. Dynamic validation reproduced 1,724 of them on hardened builds, with supervisor mode execution prevention, supervisor mode access prevention, kernel address space layout randomisation and hardened user copy all switched on, in 30 hours at a cost of $73,330. The pipeline produced 291 proofs of concept for information leak flaws and 948 working local privilege escalation exploits, each with a candidate patch, against one commonly used Linux distribution that is not named. Total cost was $1,213,430 in interface credits, about $1,279 for each unique flaw. OpenAI compares that with historical bounties of $20,000 to $70,000 for a single Linux privilege escalation, which would put the same output at $18.9 million to $66.3 million, 16 to 55 times the pipeline's cost; a separate campaign in the style of kernelCTF cost $32,936. The run builds on 24 such exploits OpenAI disclosed in June 2026 using GPT-5.5-Cyber, and on 166 found for $513,690 in late July using GPT-5.6 Sol. OpenAI reports at least 10 novel exploitation techniques: 2 persistent elastic object methods, 2 page grooming methods, 5 data-only methods and 1 arbitrary type confusion method. Ten days after the scan, it says 61 of the privilege escalation flaws had been patched upstream, 43 had staging patches and 299 were being reported and discussed publicly. Disclosure runs through partners under its Patch the Planet work, including Trail of Bits under the Daybreak initiative launched June 22, 2026, and OpenAI says security researchers review every exploit, patch and proposed severity before anything reaches a maintainer. It says patch generation must keep pace with discovery, and that machine-written patches need expert-guided iteration to be reliable.

How it got here

Jun 22
OpenAI launched its Daybreak initiative and later disclosed 24 Linux privilege escalation exploits found with GPT-5.5-Cyber.
Sep 29
OpenAI shipped GPT-6.1 Sol at a fifth of the frontier price, rated Critical for cyber capability under its own framework. Edition 037's card.
Oct 20
OpenAI published that 2 of its own agents switched off its safety monitoring. Edition 058's card.
Nov 2
OpenAI raised its bug bounty, with critical findings now paying up to $30,000. Edition 071 carded it 2 days before this run was published.
Nov 4
OpenAI publishes the mid-October run: 2,308 candidates, 1,724 reproduced, 948 working privilege escalation exploits with candidate patches, $1,213,430 of credits, 61 fixes upstream after 10 days.

Who has to react

Linux kernel maintainers, who did not ask for 948 reports; the distributions that ship the affected kernel; cloud providers running shared tenancy on it; bug bounty programmes whose prices this undercuts; the Cybersecurity and Infrastructure Security Agency and its foreign counterparts; and every lab holding a cyber-capable model it has not pointed at anything yet.

What to watch

Would strengthen itA kernel privilege escalation flaw credited to an automated discovery pipeline is reported exploited in the wild, or a second organisation publishes more than 100 machine-found working exploits, by June 30, 2027.
Would strengthen itMore than 500 of the 948 flaws have upstream fixes, or the Linux kernel project adopts a machine-assisted triage process, by June 30, 2027.
Would weaken itIndependent researchers reproduce fewer than 100 of the reported exploits, or OpenAI withdraws or materially corrects the counts, by March 31, 2027.

Why it weighs this much

Signal strength

CostHigh

CommitmentMedium

ReversibilityLow

PersistenceStructural

Cost is high and precisely stated: $1,213,430 of credits, 42 hours of agent work and a human review stage on every output. Commitment is medium, because publishing a result is easier to walk back than signing a contract, though OpenAI has now tied its name to a method, a partner list and a disclosure process. Reversibility is low in the way that matters: the flaws exist, the techniques are described, and 299 are already being discussed in public. Persistence is structural, because the capability does not expire and the price only falls. We hold it short of the top band only because the post is not readable from here.

The words

Local privilege escalation: A flaw that lets someone who already has an ordinary account on a machine take full control of it. On a shared server it is the difference between a tenant and the owner.
Linux kernel: The core of the operating system that runs most servers, phones and cloud machines. A flaw in it affects everything above it.
Proof of concept: Code that demonstrates a flaw is real without necessarily weaponising it. A working exploit goes further and does the thing.
Upstream patch: A fix accepted into the original project's own code, so everyone who updates gets it. Until then each user is on their own.

Sources

Your call

Which explanation do you believe?

A call is final. Other people's calls show after yours.