OpenAI's autonomous pipeline found 948 Linux kernel privilege-escalation flaws

OpenAI published research on November 4 describing a prototype pipeline that scans the Linux kernel inside a controlled research environment, identifies candidate security flaws, reproduces them dynamically and generates patches. In its latest run the system analysed 2,308 candidate findings, reproduced 1,724 vulnerabilities and produced 948 local privilege-escalation (LPE) exploits that could let an unprivileged local user gain root access.

The pipeline runs in five stages: discovery, dynamic validation, exploitability assessment, patch generation and human review. Scout agents first mapped 5,034 audit targets covering about 2.8 million lines of code, roughly 7% of the kernel, before Analyst agents scanned those targets and returned the 2,308 deduplicated findings within 12 hours.

Validation is where the system earns its keep. A triage agent wrote a proof of concept for each candidate, ran it in an isolated virtual machine with Kernel Address Sanitizer and iterated until the behaviour reproduced or the options ran out. Within 30 hours it had confirmed 1,724 vulnerabilities, about 74.7% of the candidates; only 3.1% turned out to be incorrect analysis that assumed an impossible condition.

OpenAI also published per-stage costs: $3,426 for scouting, $316,549 for analysis, $73,330 for validation, $44,194 for initial screening and $775,929 for exploitation, for an end-to-end total of $1,213,430 in API credits. A successful LPE exploit cost $359 on average, and the company notes that failed attempts were far more expensive per case than successful ones.

The run was not the first. In late July 2026, GPT-5.6 Sol found and exploited 166 unique LPEs under the same harness for $513,690. The mid-October scan with a newer cyber model reached 948, which OpenAI reads as evidence that previously audited code should be rescanned as models improve.

The kernel community moved quickly. When the ten-day scan and manual analysis finished, 61 LPEs had already been patched upstream, 43 had staging patches and 299 were being reported and discussed publicly. Following the maintainers' guidance, OpenAI began with critical vulnerabilities and is working with Patch the Planet partners on the rest.

Sampling 166 exploits, the researchers identified ten exploitation techniques they believed were new, including two persistent elastic objects for spraying objects inside the target kernel cache, two page-grooming methods, five data-only escalation techniques and one arbitrary type confusion. Technical details were withheld for safety.

Applying historical Pwn2Own and TyphoonPWN bounty values of $20,000 and $70,000 to the 948 exploits implies a hypothetical value of $18.9 million to $66.3 million, 16x to 55x the pipeline's cost. A separate 112-hour run against Google's kernelCTF environment cost roughly $32,936 and produced 25 information-leak proofs of concept and 21 LPE exploits. OpenAI also reports that in an early run, 20 of 200 'successful' escalations had actually used a different zero-day, a reminder that autonomous results still need independent verification.