OpenAI mints 948 Linux root exploits in $1.2M pipeline run

OpenAI says a single autonomous run of an upcoming cyber model produced 948 working Linux privilege-escalation exploits, each shipping with a candidate patch, for $1,213,430 in API credits — about $1,279 per unique flaw. The company posted the writeup on November 4, 2026.

The pipeline started on the latest Linux kernel, more than 40 million lines of code, and used scout agents to narrow it to 5,034 audit targets covering roughly 2.8 million lines, about 7 percent of the codebase. Analyst agents produced 2,308 deduplicated candidate findings in 12 hours. A dynamic validation stage then reproduced 1,724 of them on hardened builds with SMEP, SMAP, KASLR and HARDENED_USERCOPY enabled, taking 30 hours and costing $73,330. The final stage delivered 948 LPE exploits, each paired with a root-cause analysis and a minimal crashing proof of concept. Ten days after the mid-October 2026 scan, OpenAI reports 61 of the LPEs patched upstream, 43 with staging patches, and 299 being reported and discussed publicly.

"The flaws could give an unprivileged local user root access," the post states.

OpenAI frames the cost comparison bluntly. Against historical Pwn2Own and TyphoonPWN bounties of $20,000 to $70,000 per Linux LPE, the 948 exploits would represent $18.9 million to $66.3 million in bounty value, or 16x to 55x the pipeline's cost. A separate kernelCTF-style campaign cited in the same piece ran for $32,936 against a $71,337 per-eligible-exploit Google reward.

Disclosure is coordinated through OpenAI's Patch the Planet partners, including Trail of Bits under the Daybreak initiative launched on June 22, 2026. "Our goal is to help defenders find and fix vulnerabilities before attackers can use them. We're working with Linux maintainers and Patch the Planet partners on reports and patches," OpenAI said on X. Every output is reviewed before any report leaves the lab, the company says, so nothing reaches maintainers without human sign-off.

The scaling line is the one OpenAI chose to lead with. In late July, an earlier cyber model the company calls GPT-5.6 Sol produced 166 unique LPEs for $513,690. Three months and one model later, on a kernel that had been hardened in the interim, the number is 948. The release lands inside a dense run of OpenAI items on our tracker, and it is a harder one than most to file as incremental.