$1.21 Million, 948 Roots: OpenAI Turned Vulnerability Discovery Into an Assembly Line

On November 4, OpenAI’s security team announced an autonomous vulnerability research pipeline. The goal was specific: find vulnerabilities, validate them, write exploits, and generate patches. They ran it against the Linux kernel. In a single run, the system reproduced 1,724 vulnerabilities, produced 291 information-leak PoCs and 1,169 working local privilege-escalation exploits. After merging by variant, these were 948 distinct local privilege-escalation vulnerabilities. The API bill was $1,213,430, averaging about $1,279 each.

Local privilege-escalation vulnerabilities (LPEs) can be understood by ordinary users this way: an attacker already has a low-privilege account and then uses a kernel vulnerability to become root. The Linux kernel has more than 40 million lines of code, and phones, cloud servers, and supercomputers all use it. OpenAI chose it because both its scale and impact are large enough.

The pipeline has five steps: discovery, dynamic validation, exploitability assessment, patch generation, and human review. In the discovery phase, Scout agents selected 5,034 audit targets, about 2.8 million lines of code, or 7% of the kernel, at a cost of $3,426. Analyst agents produced 2,308 candidates within 12 hours at a cost of $316,549. In the validation phase, candidates were placed in isolated virtual machines and PoCs were run with KASAN; 1,724 were reproduced in 30 hours, or 74.7%, at a cost of $73,330. After filtering, 313 information-leak candidates and 1,238 local privilege-escalation candidates remained; filtering cost $44,194. The exploit-development phase cost $775,929 in total, of which $84,929 was for information leaks and $691,000 for local privilege escalation. Successfully developing one exploit cost an average of $359. The 69 failures averaged $3,922, mainly stuck on hard-to-exploit vulnerabilities such as races. OpenAI says setting a cap on give-up conditions can save a lot of money.

Cost comparison is the most striking part of this research. Historically, Pwn2Own and TyphoonPWN have offered bounties of $20,000 and $70,000, respectively, for Linux kernel LPEs. Applying those two numbers to 948 exploits gives an imaginary value between $18.9 million and $66.3 million, 16 to 55 times the pipeline cost. In the kernelCTF environment, they obtained 25 information-leak PoCs and 21 LPE exploits at a total cost of about $32,936. If these 21 vulnerabilities were accepted by the project, the bounty would be about $1.5 million, roughly 45 times the cost. OpenAI’s conclusion is direct: measured by public bounties, this pipeline was net profitable at the time of the research. Defenders should proactively analyze software and make the cost of attack high enough to be uneconomical.

But don’t just look at the number 948. In an early run, the exploitation phase reported 200 successful local privilege escalations; manual review found that 20 of them obtained root through another 0-day, not through the vulnerability assigned to them. The team then tightened constraints and added independent checks to confirm that each final exploit actually used the specified vulnerability. This detail is more important than 'AI automatically finds bugs.' Automated results also need their paths validated; isolation, monitoring, and independent checks cannot be skipped.

Patch generation is not a one-click process either. Directly asking a model to write patches can produce functional but overlong code, performance trade-offs, departures from coding style, and failure to check for variants of the same flaw. Only after adding static checks, following nearby code practices, and doing variant analysis did patch quality improve. OpenAI says that in a small number of cases, the prototype also found problems in human-expert patches and fixed them before merge. Human review is still at the end of the process; researchers look at exploits, patches, and suggested severity, then report to maintainers.

Changes in model capability are also worth noting. In July 2026, GPT-5.6 Sol found and exploited 166 distinct LPEs at an end-to-end cost of $513,690. In October, the new cyber model found and exploited 948 at a cost of $1,213,430. OpenAI also observed that, after sampling 166 exploits, the agent used at least 10 previously unknown Linux exploitation techniques: 2 new persistent elastic objects, 2 page grooming techniques, 5 data-only privilege-escalation techniques, and 1 arbitrary type confusion. Details were not disclosed. Another incident: during a kernelCTF run, the prototype also found and exploited a vulnerability in QEMU TCG. At the time, the analysis agent did not have QEMU source code; it first saw a kernel crash and then traced it back to QEMU. This vulnerability had already been fixed upstream, but the release build used in the experiment did not include the fix.

The orchestration strategy is also counterintuitive. Early GPT-5.5 Cyber could not reliably determine when to use which Linux exploitation technique. The team organized 103 techniques into a model-friendly format and put them in the environment, raising the success rate on 63 exploit candidates from 76.2% to 88.9%. Switching to GPT-5.6 Cyber, the model itself was better at finding, selecting, and using techniques. After removing heavy orchestration, lightly orchestrated GPT-5.6 Cyber outperformed heavily orchestrated GPT-5.5 Cyber. Adding the technique layer back improved performance by only 1.5 percentage points. OpenAI’s advice is that when base model capabilities change, orchestration and harnesses should be re-evaluated; don’t spend maintenance cost on marginal gains.

Maintainer response speed was also recorded. The scan targeted the latest Linux kernel in mid-October 2026. Ten days later, the autonomous scan and manual analysis were complete: 61 LPEs had been patched upstream, 43 had staging patches, and 299 were being publicly reported and discussed. OpenAI says this reflects the rapid response of maintainers and the security community. For users and companies, the conclusion is not complicated: patch promptly. OpenAI also warns that in the near to medium term, a low-privilege account plus a system without the latest patches is functionally roughly equivalent to root for a well-resourced attacker. Sandboxes and isolation, such as Firecracker and gVisor, remain important to limit the blast radius after a vulnerability is exploited.

Looking further ahead, OpenAI judges that in the coming years, if a software project has vulnerabilities, frontier models will very likely be able to find them. After disclosure, less capable models may also be able to write exploits. In a world without unknown vulnerabilities, old topics—high-assurance software, secure-by-default coding, reducing attack surface, and formal verification—will become more important. The original research is here, and the Patch the Planet project is here.

The picture this paints is this: on one side are 948 root exploits; on the other is the maintainers’ inbox. AI security narratives are often written as far-off risk; this time it looks more like a bill: $1.21 million bought 948 paths to root. Whether it can be defended against depends on patches, isolation, and review, not on whether we are scared by the numbers.