A thousand fewer paths to root
A · Strong evidence OpenAI's cyber team documents an autonomous Linux kernel pipeline stage by stage, with counts, API costs per stage, a model-to-model comparison and failure cases; a lab self-report without independent verification or released exploits.
Summary based on the full text·Original: about 20 minutes to read
In short
A 4 November 2026 OpenAI security publication on an autonomous pipeline that finds, validates, exploits and patches Linux kernel vulnerabilities, run with an upcoming cyber model. One run in mid-October produced 948 distinct local privilege escalation (LPE) exploits on a stock desktop distribution for about $1.2 million in API credits, with candidate patches sent to maintainers. The authors argue discovery is no longer the bottleneck: validation, prioritisation and patching are.
Key numbers
- 2,308 / 1,724candidate kernel findings after deduplication / vulnerabilities dynamically reproduced (~74.7%)
- 948distinct local privilege escalation vulnerabilities with working exploits and patches, in one mid-October 2026 run
- $1,213,430API cost of the full run, or $1,279 per local privilege escalation exploit
- 166 vs 948unique escalation vulnerabilities found by GPT-5.6 Sol in July vs the newer cyber model in October
- 20 of 200early 'successful' exploits that reached root through a different 0-day than the one assigned
As reported by the source.
English·Web page·opens openai.com
What it reports
- Scout agents picked 5,034 audit targets (about 2.8 million lines, roughly 7% of the kernel) for $3,426; analyst agents produced 2,308 candidate findings in 12 hours for $316,549.
- Validation in KASAN-instrumented VMs reproduced 1,724 (about 74.7%) in 30 hours for $73,330; only 3.1% reflected incorrect analysis.
- Screening left 1,238 LPE and 313 information-leak candidates. Exploit agents, with standard protections enabled, produced 1,169 working LPE exploits and 291 leak PoCs; variant analysis gave 948 distinct patches. The exploitation stage cost $775,929.
- Hypothetical value of the 948 exploits at historical Pwn2Own and TyphoonPWN bounties: $18.9M to $66.3M, 16x to 55x the cost. On hardened kernelCTF: 21 LPE exploits for about $32,936, against 26 accepted 0-day LPEs in kernelCTF so far in 2026.
- Stronger models find more: GPT-5.6 Sol in July found 166 unique LPEs for $513,690; the newer model found 948 in October despite three months of hardening.
- At least 10 exploitation techniques new to third-party experts; one QEMU vulnerability found in the test infrastructure.
- In an early run, 20 of 200 reported exploits used a different 0-day than assigned, which led to an independent check.
- Within 10 days, 61 LPEs had been patched upstream, 43 had staging patches and 299 were being discussed publicly.
How they got it
A five-stage agent pipeline (discovery, dynamic validation, exploitability assessment, patch generation, human review) run inside a controlled research environment, with per-stage API costs reported. Human researchers reviewed outputs before reporting to maintainers under the Patch the Planet initiative.
Limits
- Self-reported by the model developer; the model is unreleased, and exploits and techniques are withheld for safety, so results cannot be checked externally.
- Bounty valuations are hypothetical; costs are presented as an upper bound and exclude staff time.
- Patch quality is described qualitatively; the share of patches accepted by maintainers is not given.
Why it matters for companies
For planning, the authors' advice is the useful line: a low-privileged account on an unpatched system should be treated as close to root for a well-resourced attacker. Patch cadence for operating systems, browsers and core libraries becomes a direct risk control, as does sandboxing to limit blast radius. Code already audited should be rescanned as models improve. Firms running their own AI security tooling should also verify the path to a result, not only the result, since agents can reach the goal by an unintended route.
Summary based on the full text. Read the original for the full argument and data.Read the original on openai.com