OpenAI’s unreleased AI found 948 Linux root bugs for $1.2 million

OpenAI has built a system that hunts for the most valuable kind of Linux bug, the one that turns an ordinary user account into full control of the machine, and it finds them by the hundreds. In one run, its pipeline located nearly a thousand distinct flaws of that kind in the Linux kernel, wrote a working attack for each and drafted a candidate fix for maintainers to review. The AI model that did the work is not public.

The kernel sits under Android phones, most of the world’s servers, cloud platforms, Chromebooks and supercomputers. A privilege-escalation bug does not let a stranger in on its own. It lets someone who already has a foothold, such as a malicious app, a stolen low-level login or a compromised container, become root. OpenAI’s own advice is blunt: on an unpatched system, treat any low-privileged account as equivalent to root for a well-resourced attacker.

The pipeline works like a security team split into roles. Scout agents picked 5,034 parts of the kernel that an unprivileged user can reach, about 2.8 million lines or roughly 7% of the code. Analyst agents turned those into 2,308 candidate findings in 12 hours. A triage stage then reproduced 1,724 of them inside virtual machines within 30 hours, and OpenAI says only 3.1% of the remaining findings failed because the model’s analysis was wrong. Exploit agents produced 1,169 working privilege-escalation exploits and 291 information leaks against a stock desktop setup with the standard kernel protections switched on. Variant analysis merged those exploits into 948 unique bugs, each with a candidate patch.

The bill came to $1,213,430 in API credits, or about $1,279 per unique bug, according to OpenAI’s report. Hacking contests such as Pwn2Own and TyphoonPWN have paid $20,000 and $70,000 for a single Linux root exploit. At those prices the haul would be worth between $18.9 million and $66.3 million. Work that once needed a scarce specialist now costs, per bug, roughly what a mid-range laptop does.

The curve matters more than the total. An earlier run with GPT-5.6 Sol, one of OpenAI’s existing models, scanned the then-current kernel and found 166 unique bugs for $513,690. The newer cyber model found more than five times as many new ones, even though the kernel had absorbed three months of hardening between the two scans. A sample of 166 exploits contained ten techniques that OpenAI’s team and outside kernel experts considered new. The company has withheld the details. On Google‘s deliberately hardened kernelCTF target, a separate 112-hour run produced 21 working exploits for about $32,936.

Several things the numbers do not show. Every figure comes from OpenAI, and no outside group has audited the run. The 948 is a count of candidate patches, not merged fixes. By the end of the ten-day scan, 61 of the bugs had been fixed upstream, 43 had patches in staging and 299 were already public or under discussion, so a good share were not news to the kernel community. OpenAI also caught its own system taking shortcuts: in an early run, 20 of 200 reported successes had reached root through a different unknown bug than the one they were assigned. Early AI-written patches were sometimes correct but padded with unnecessary code or out of step with kernel style, and human researchers still review every exploit and patch before anything goes to maintainers.

That review step is where the pressure lands. Kernel maintainers, many of them volunteers or company engineers with other duties, now face a queue that a machine can refill faster than people can clear it. OpenAI recommends that reports be revalidated against current code before submission so maintainers don’t waste time on bugs that are already fixed. It has not said how many of the 948 reach the kernels that phone makers ship. On Android, a kernel fix only reaches users when each manufacturer pushes it, and phones that no longer get security updates stay exposed.

For anyone running Linux, the practical response is the old one with higher stakes: install kernel updates promptly, and isolate untrusted code. OpenAI points administrators to sandboxing tools such as Firecracker and gVisor, and to rescanning their own code as models improve. The cyber model itself is not available to the public in any country; OpenAI calls it upcoming and has given no price or release date. The bug reports reach maintainers through its Patch the Planet program with security partners.

OpenAI published the report, titled A thousand fewer paths to root, on November 4. The run took place over ten days in mid-October against the latest kernel master branch, and the earlier GPT-5.6 Sol scan dates from late July. OpenAI says it has already sent hundreds of reports and patches for critical bugs and will hand over the rest gradually through its partners. When the scan closed, roughly one in nine of the 948 had a fix upstream or in staging.

Tags: OpenAI, Cybersecurity, AI security, Linux, GPT-5.6 Sol, vulnerabilities