OpenAI’s AI Pipeline Found 948 Linux Root Exploits for $1,279 Each

$1,213,430 in API credits. 948 working root exploits against the Linux kernel. One run, mid-October, published by OpenAI on November 4 under the title “A thousand fewer paths to root.” The number that actually tells you something, though, isn’t 948. It’s $1,279 — the average cost per exploit, against a historical bug-bounty range of $20,000 to $70,000 for the same class of bug. That’s a 16x to 55x cost collapse, by OpenAI’s own comparison, and it’s the number that should change how every security team thinks about its patch backlog.

How the pipeline actually works

The run starts by pointing scout agents at the full Linux kernel source, about 40 million lines, and asking them to narrow it to the parts worth a closer look. Twelve hours later, that narrowing produced 2.8 million lines — 7% of the codebase — and 2,308 deduplicated candidate findings. The next 30 hours were dynamic validation: taking each candidate and actually trying to reproduce it against hardened kernel builds running SMEP, SMAP, KASLR, and HARDENED_USERCOPY, the mitigations that are supposed to make this exact class of bug hard to weaponize. 1,724 candidates reproduced. Of those, 948 became complete, working local-privilege-escalation exploits — code that takes an unprivileged local user to root.

This isn’t OpenAI’s first run at this. An earlier model, internally called GPT-5.6 Sol, produced 166 exploits for $513,690 back in July. Going from 166 exploits at roughly $3,095 each to 948 at $1,279 each in three months is the part that deserves more attention than the raw exploit count. The trend isn’t “AI found more bugs.” It’s the cost per validated exploit dropping fast enough that the economics of large-scale kernel auditing just changed for whoever has access to a model like this — attacker or defender.

The patch status is the uncomfortable part

Ten days after the scan, OpenAI’s own numbers: 61 of the 948 exploits had a patch merged upstream. 43 more had a patch in staging. 299 were reported and under public discussion. Add those together and you’re still under half of 948 with any visible remediation progress after ten days. That gap is not a criticism of the Linux kernel maintainers — reviewing, testing, and merging 948 independent LPE reports in ten days was never going to happen, no matter how good the patches are. It’s the actual shape of the problem this pipeline creates: discovery now runs faster than any human review process can match, at a scale that used to take a security research team years to produce, and the review bottleneck doesn’t close just because the agent doing the finding is more disciplined than past approaches.

OpenAI is explicit that every output gets reviewed before anything leaves the lab, and that’s the right policy for the lab running the pipeline. It doesn’t tell you anything about what happens when a less careful actor builds something similar without that review gate, and the gap between “this is responsible when OpenAI does it” and “this capability now exists” is exactly the gap worth tracking. A tool that turns $1.2 million into 948 root exploits is not a tool only well-intentioned labs can build.

What this means if you maintain or depend on kernel code

If your organization ships anything running on Linux — which is most organizations — the practical takeaway isn’t “wait for OpenAI to patch things for you.” It’s that your own exposure window for kernel-level LPE bugs just got shorter on both sides: shorter for whoever’s trying to find bugs in your stack, and shorter for how long you can reasonably assume an unpatched kernel bug stays undiscovered. The old assumption that obscure kernel code paths are safe because nobody’s looking closely enough to find the bug in them doesn’t hold the same way it did a year ago, when finding a bug like this meant months of specialist human effort instead of a $1.2 million, two-day machine run.

The concrete move here isn’t exotic. Track your kernel version’s patch cadence against CVE disclosure dates more closely than you have been, treat any LPE CVE as time-sensitive rather than routine, and don’t assume a bug class is theoretical just because it requires local access — plenty of real-world intrusions already have local access by the time privilege escalation matters. The other 887 exploits from this run that aren’t yet patched upstream are, as of today, out there in some documented form. That’s not a hypothetical future risk. It’s the current state of the Linux kernel’s attack surface, published by the people who built the tool that found it.

Sources

AI Weekly: OpenAI mints 948 Linux root exploits in $1.2M pipeline run, reporting on OpenAI’s November 4, 2026 announcement “A thousand fewer paths to root.”