OpenAI agents found 948 ways to root Linux: what the run actually showed
Quick answer
OpenAI published on Nov 4 that an autonomous vulnerability pipeline, powered by an upcoming cyber model, scanned the Linux kernel in mid-October 2026, dynamically reproduced 1,724 vulnerabilities, and produced 948 working local privilege-escalation (LPE) exploits that can take an unprivileged local user to root (OpenAI). The full run cost $1,213,430 in API credits (~$1,279 per LPE). Humans reviewed the outputs; OpenAI is reporting critical findings and candidate patches with Patch the Planet partners.
The numbers OpenAI published
- Candidates: 2,308 after deduplication.
- Reproduced: 1,724 (~74.7% of candidates) inside isolated VMs with KASAN.
- Working LPEs: 948 distinct local privilege-escalation exploits on a stock desktop Linux distribution.
- Info leaks: 291 proofs of concept.
- Cost: $1.21M total API credits for the main run.
How the pipeline worked
- Scout agents picked ~5,034 audit targets (~2.8M lines, ~7% of the kernel).
- Analyst agents produced candidate findings.
- Triage agents tried to reproduce each finding in isolation.
- ExploitDev agents tested whether findings could leak info or escalate to root, with stock mitigations on (SMEP, SMAP, KASLR, HARDENED_USERCOPY).
- The system generated candidate patches; human researchers review before upstream reports.
What OpenAI wants readers to take away
- Discovery is getting cheap to scale; validation and prioritization are the bottlenecks.
- Maintainers moved fast: within ~10 days of the scan, OpenAI says 61 LPEs were already patched upstream, 43 had staging patches, and ~299 were being discussed publicly.
- Stronger models find more: a mid-October cyber-model run found >5x more novel LPEs than a GPT-5.6 Sol run in July on the then-latest master branch.
- Near term, OpenAI argues a low-privileged account on an unpatched OS should be treated as functionally equivalent to root for a well-resourced attacker — sandboxes like Firecracker and gVisor matter.
FAQ
- Are these public exploit dumps? OpenAI says it is coordinating disclosure and patches; it is not publishing a free exploit kit for attackers.
- Does this mean my laptop is owned today? Only if an attacker already has a local foothold and the specific bug is still unpatched on your kernel. Keep systems updated.
- Is this the same as Astra? No. This post is about OpenAI’s cyber research pipeline and an upcoming cyber model, not the Astra hardware-design demo from earlier this week.