Linux kernel vulnerabilities: OpenAI agents wrote 948 exploits

On November 4, OpenAI’s security research team published a report called “A thousand fewer paths to root”. It describes an autonomous agent pipeline that hunts for Linux kernel vulnerabilities, writes exploits for them and drafts fixes. In a single run with OpenAI’s internal cybersecurity model, it confirmed and prepared fixes for 948 local privilege escalation vulnerabilities, the kind that let an ordinary user become root. API cost: roughly $1.2 million.

What exactly did the OpenAI agents find?

The numbers from the report (summarized by, among others, ai-tldr.dev and RuntimeWire) look like this:

1. 2,308 candidate vulnerabilities in the kernel’s master branch as of mid-October 2026,
2. 1,724 of them were reproduced as real vulnerabilities,
3. 948 unique LPE vulnerabilities (local privilege escalation) ended with a working exploit and a proposed fix,
4. the total cost was $1,213,430 in API credits, most of it, $775,929, spent on writing exploits (finding the bugs cost $316,549 and validating them $73,330).

According to OpenAI, the agents used 10 exploitation techniques that outside kernel experts had not seen before. The company is not publishing those techniques.

The model that did this is not publicly available. It’s an upcoming, specialized OpenAI cybersecurity model whose name the coverage didn’t give.

How did the agents hunt for Linux kernel vulnerabilities?

The pipeline splits the work between several kinds of agents (as ai-tldr.dev describes it):

1. scout agents picked 5,034 targets, pieces of code reachable by an unprivileged user (about 7% of the kernel’s code),
2. analyst agents searched those pieces,
3. triage agents wrote a proof of concept for every finding and ran it in a virtual machine with KASAN (Kernel Address Sanitizer) until the bug reproduced,
4. exploit agents tested the strongest candidates on a regular distribution with SMEP, SMAP and KASLR protections enabled,
5. the last stage wrote the fixes.

Interestingly, early in the run 20 of 200 “successful” exploits got root through a completely different zero-day than the one the agent was supposed to use. That’s why the pipeline has extra checks to confirm an exploit really uses its assigned bug.

The team also tested the pipeline on a hardened kernel from Google’s kernelCTF program. In 112 hours it produced 25 information-leak proofs of concept and 21 LPE exploits, for about $32,936 in API credits.

Are these vulnerabilities patched yet?

Not all of them. 948 is the number of confirmed exploits with candidate fixes, not 948 fixes in the kernel. After 10 days, 61 vulnerabilities were patched in the mainline kernel, and fixes for another 43 were waiting in staging branches.

On the kernel community’s advice, OpenAI started with the critical bugs and is reporting the rest gradually, together with partners in the Patch the Planet program. According to Startup Fortune, the program launched in June 2026 with Trail of Bits and HackerOne among others, and humans review every finding before it reaches a maintainer.

Why is everyone talking about it?

Because the scale impresses even security people. The report hit the front page of Hacker News, where a team member is answering questions. One question keeps coming up in the comments: how could the kernel hide almost a thousand paths to root?

The report’s own conclusion lands hardest: for now, a low-privileged account on a system without the latest patches should be treated as root access for a well-equipped attacker (in its words, “functionally equivalent to root access for a well-resourced threat actor”).

It’s another signal pointing the same way. At the end of October, Claude found vulnerabilities in Chrome, Safari and Linux, and Google showed Gemini 4 Carbon, a cybersecurity model for select companies only. The difference is that here we’re talking about hundreds of vulnerabilities in one run, and a concrete API bill.

What should we watch out for?

First, who is supplying the numbers. This is an experiment run and described by OpenAI itself, and the company calls the costs an upper bound, since a better harness could lower them. There isn’t much independent verification yet, so let’s take them with a grain of salt.

Second, the other side of the coin. The same tool in attackers’ hands would shorten the time from a kernel commit to a working exploit. OpenAI’s answer is that the model isn’t public, and the exploits and new techniques aren’t being released.

Third, updates. OpenAI’s advice to defenders is simple: rescan old code as better models arrive, and keep systems patched. I write more about protecting agents and keys in my guide to AI agent security.

FAQ

How many Linux kernel vulnerabilities did OpenAI find?

The pipeline flagged 2,308 candidates, reproduced 1,724 vulnerabilities and, for 948 unique LPE vulnerabilities, wrote a working exploit and a proposed fix.

Is my Linux system at risk?

The exploits haven’t been published, and fixes are reaching the kernel gradually (61 were in mainline after 10 days). The best thing we can do is update the kernel regularly.

Can I try this OpenAI model?

No. According to the coverage, it’s an upcoming, not yet released OpenAI cybersecurity model.

How much did it cost?

According to OpenAI, $1,213,430 in API credits for the whole run.