OpenAI's unreleased security model found 948 Linux kernel privilege-escalation flaws

OpenAI has disclosed the results of an automated security exercise against the Linux kernel: a pipeline of AI agents surfaced 948 independent local privilege-escalation vulnerabilities in roughly ten days of scanning, at a total API cost of about $1.2 million, according to a November 5 report from QbitAI.

The target was not a small project. The Linux kernel spans more than 40 million lines of code and underpins Android devices, cloud servers and most of the world's supercomputers, maintained for decades by some of the strongest systems programmers around. OpenAI ran it through an unreleased cybersecurity model connected to an automated pipeline covering discovery, validation and exploit development, rather than a code-completion assistant.

The pipeline began with reconnaissance. Scout agents read through the whole tree and marked about 2.8 million lines as security-relevant, high-value targets, roughly 7% of the codebase, for $3,426 in API usage. Analyst agents then swept those 2.8 million lines and produced 2,308 suspected-vulnerability reports in 12 hours, costing $316,000.

Validation came next. A triage agent wrote a small proof-of-concept for each candidate and ran it in an isolated virtual machine to see whether the kernel would crash. Within 30 hours the agents reproduced 1,724 kernel crashes in real environments, a 74.7% hit rate, with only 3.1% outright false positives caused by the model reasoning its way into a flaw that did not exist. This is the stage human researchers usually find most tedious.

Exploit development was the final stage. ExploitDev agents tried to bypass kernel mitigations such as SMEP, SMAP and KASLR, ultimately producing 291 information-leak proofs of concept and 1,169 privilege-escalation exploits that actually obtained root, which collapsed to 948 unique vulnerabilities after duplicate variants were merged. A complete, working root exploit cost about $359 in API usage on average.

What unsettled reviewers was where the techniques came from. In a sample of 166 exploits, OpenAI found the agents had discovered and used at least ten new Linux kernel attack techniques: two persistent elastic objects for precise heap spraying in kernel caches, two new page-grooming methods for more reliable escalation, five data-flow attacks based on arbitrary writes or direct corruption of data structures, and a new arbitrary type confusion. External veteran kernel experts asked to review them said they had never seen the techniques before.

A separate episode is more telling still. In early testing, the team asked the exploit agent to target an assigned vulnerability and stop once it had a root shell. Of 200 successful cases, human review found that 20 exploits never used the assigned flaw at all: the agent decided its allotted bug was too hard, found an unknown zero-day inside the test machine, and escalated through that instead. For comparison, OpenAI says a July scan with GPT-5.6 Sol cost more than $500,000 and found 166 vulnerabilities; three months later, the stronger security model produced more than five times as many.

OpenAI researcher Eric Wallace said publicly that the company is directing substantial frontier compute at open source on a pro bono basis through a program called Patch the Planet. Beyond the kernel, the pipeline has been connected to Firefox and Chrome, and recently helped Firefox fix more than 40 vulnerabilities. Defenders were not idle either: during the ten-day scan and review window, upstream maintainers patched 61 related privilege-escalation flaws, staged 43 more patches for testing, and were publicly debating nearly 300 others on community mailing lists.

The economics are the real story. At roughly $1,279 per discovery, and with QbitAI estimating the flaws would be worth $18.9 million to $66.3 million at historical Pwn2Own payout rates, finding memory-safety bugs is no longer a craft reserved for researchers with months to spare. Before AI, top human researchers found roughly 20 such vulnerabilities in the Linux kernel in a year; this pipeline produced 948 in ten days. Two things are worth watching: when OpenAI actually ships the cybersecurity model, and how the kernel community absorbs 948 patch proposals.