OpenAI's Cyber Model Built 948 Working Linux Root Exploits in One Run for About $1.2 Million

OpenAI pointed an unreleased cyber model at the Linux kernel for a few days in October. It came back with working root exploits for 948 distinct bugs, and a bill of about $1.2 million.

The company laid out the run in a research post titled "A thousand fewer paths to root." Its conclusion is blunt. For the near and medium term, OpenAI says, a low-privileged account on an operating system that is behind on patches should be treated as functionally equivalent to root for a well-resourced attacker.

From 2,308 leads to 948 exploits

The pipeline handles discovery, dynamic validation, exploitability assessment and patch generation on its own. Scout agents picked 5,034 audit targets covering about 2.8 million lines, roughly 7% of the kernel. Analyst agents turned those into 2,308 candidate findings in about 12 hours.

Validation took around 30 hours and reproduced 1,724 vulnerabilities. Only about 3.1% of candidates turned out to be wrong analysis. From there the system produced 291 information leak proofs of concept and 1,169 working local privilege escalation exploits, which collapsed to 948 distinct patches after variant analysis.

The total cost was $1,213,430 in API credits, or about $1,279 per exploit. A successful exploit took about $359 in credits on average. The targets were stock desktop Linux builds with SMEP, SMAP, KASLR and hardened usercopy switched on, not a softened lab box.

OpenAI frames the value with past bounty prices of $20,000 and $70,000 for a kernel privilege escalation. At those rates, the haul would be worth somewhere between $18.9 million and $66.3 million, or 16 to 55 times what the run cost.

Faster than the last model, and new tricks

A late July run with GPT-5.6 Sol found 166 unique privilege escalations for $513,690. The October model found more than five times as many novel ones, even after three months of kernel hardening in between.

OpenAI says the work surfaced at least 10 Linux exploitation techniques that were new to it and to outside kernel experts. It is withholding the details. Human researchers reviewed findings before they went to maintainers, and the remaining reports are going out in stages with partners in its Patch the Planet effort, after hundreds of reports and patches for critical flaws were already submitted.

That human check matters. In an early run, 20 of 200 supposedly successful exploits got root through a different zero day than the one they were assigned, and the pipeline had to be tightened.

In an adapted version of Google's kernelCTF environment, the system produced 25 info leaks and 21 privilege escalation exploits over 112 hours for about $32,936. For scale, kernelCTF had accepted 26 confirmed zero day privilege escalations in all of 2026 at the time of writing. The same model also turned up 81 previously unknown high severity flaws in Firefox.

The patch queue is already moving

Kernel developers are not standing still. In the 10 days the scan ran, OpenAI counted more than 100 Linux privilege escalations patched or staged by other contributors, with about 300 more discussed publicly.

Everyday Linux systems already had a rough week. Debian and Ubuntu just rushed out fixes for an APT flaw that let network attackers swap packages and run code as root. OpenAI's pipeline suggests the next thousand paths to root will be found by machines, on a budget, and that the race is now about who patches first. The company points to sandboxes and isolation layers such as Firecracker and gVisor as the defense in depth that buys time.

Some offers on this page may be paid placements or contain affiliate links.