OpenAI says AI agents built root exploits for 948 Linux kernel bugs

OpenAI says an autonomous pipeline driven by an unreleased cyber model built working root exploits for 948 unique Linux kernel vulnerabilities in a single run, at a cost of $1.2 million in API credits. The mid-October scan targeted the most recent code in the kernel's master branch.

The agents first narrowed the kernel to security-relevant areas reachable by low-privileged users, then flagged 2,308 potential bugs and confirmed 1,724 of them. Exploits were tested on virtual machines running an unmodified desktop Linux setup with protections such as KASLR, SMEP and SMAP turned on. The run produced 1,169 working local privilege escalation exploits and 291 proofs of concept for information leaks. The 948 figure is the number of separate patches created for the bugs behind those exploits.

OpenAI says its researchers checked the exploits, fixes and proposed severity before anything went to kernel maintainers, and that it has already submitted hundreds of reports and patches for critical flaws, with the rest to follow in stages.

The company says the agents found at least 10 novel Linux exploitation techniques, and that kernel exploitation experts outside OpenAI weren't familiar with them either. Technical details are being kept private.

An earlier scan in late July, powered by GPT-5.6 Sol, yielded 166 unique LPEs at a cost of $513,690. OpenAI notes the October run found more than five times as many new LPEs even though the kernel had gone through three months of hardening in between.

The pipeline was also pointed at an adapted version of Google's kernelCTF, whose target kernel is hardened and exposes less attack surface. Over 112 hours and about $33,000 in API credits, it delivered 21 LPE exploits.

OpenAI's own advice to defenders is blunt: for the near and medium term, a low-privileged account on an operating system that isn't up to date on patches should be treated as functionally equivalent to root for a well-resourced threat actor. It points to sandboxing and isolation such as Firecracker and gVisor to limit damage when a flaw is exploited.

We'd read the patch backlog as the practical part. The exploit count is OpenAI's own accounting, and the write-ups aren't public, so nobody outside can check the 948 number yet. What is checkable is whether the boxes you run are current.

Separately, OpenAI said on November 2 that it is raising payouts in its Security Bug Bounty program, with the midpoint of ranges for medium-, high- and critical-severity bugs now more than four times higher on average.