OpenAI’s cyber agents find 948 Linux flaws, uncover 10 ways to break system defenses

Key Takeaways

• OpenAI's pipeline identified 948 distinct Linux local privilege-escalation vulnerabilities after reproducing 1,724 candidate flaws.

• Researchers found at least 10 previously undocumented exploitation techniques in a sample of 166 exploits.

• The October campaign cost $1.21 million in API credits and found more than five times as many unique LPE vulnerabilities as a July run.

OpenAI has developed an automated cybersecurity research pipeline that identified 948 distinct Linux kernel vulnerabilities capable of allowing local users to gain root access, while uncovering at least 10 previously undocumented exploitation techniques.

The system analyzed thousands of potential security issues, reproduced vulnerabilities in controlled environments and generated working exploits and candidate patches for human review.

In a research post, OpenAI said the pipeline identified 2,308 candidate findings and dynamically reproduced 1,724 of them. It subsequently generated 1,169 working local privilege escalation (LPE) exploits, which variant analysis narrowed to 948 distinct vulnerabilities.

The mid-October 2026 campaign used an upcoming cyber model that the company has not yet publicly identified. The full run cost $1.21 million in API credits, averaging about $1,279 per distinct LPE vulnerability.

The research highlights how increasingly capable models could help security teams identify and fix flaws in critical software before attackers exploit them.

Automated security pipeline

OpenAI’s system followed a five-stage process covering vulnerability discovery, dynamic validation, exploitability assessment, patch generation and human review.

Scout agents first identified security-relevant sections of the Linux kernel, narrowing the audit to 5,034 targets covering about 2.8 million lines of code, or roughly 7 percent of the codebase.

More from AI and Robotics

Analyst agents then examined those targets and produced 2,308 candidate findings within 12 hours. The system attempted to reproduce each issue inside isolated virtual machines, confirming 1,724 vulnerabilities within 30 hours.

Exploit-development agents tested whether the validated flaws could expose information or enable local privilege escalation. The system produced 291 information-leak proofs of concept and 1,169 working LPE exploits.

Variant analysis identified 948 distinct vulnerabilities behind those exploits. The pipeline also generated candidate patches, with human security researchers reviewing the findings before they were reported to maintainers.

OpenAI said it had already sent hundreds of reports and patches for critical vulnerabilities, following guidance from the Linux kernel community. It is working with Patch the Planet partners to report and address additional issues.

New exploitation methods

The researchers sampled 166 exploits and found that theagentshad used at least 10 exploitation techniques that, to their knowledge, were previously undocumented. Third-party kernel exploitation experts consulted by the team also considered the techniques new.

These included methods for placing objects inside kernel memorycaches, improving exploit reliability and obtaining privilege escalation through data-only attacks.

The newer pipeline also showed a substantial increase over an earlier campaign. In July 2026, GPT-5.6 Sol found and exploited 166 unique LPE vulnerabilities at a cost of $513,690. The October run identified 948, more than five times as many, despite three months of additional kernel hardening.

OpenAI compared the 948 vulnerabilities with historicalLinuxkernel bug bounty payouts from Pwn2Own and TyphoonPWN. Applying those past rewards produced a hypothetical valuation of $18.9 million to $66.3 million, or 16 to 55 times the pipeline’s cost. This is an illustrative comparison, not actual bounty income.

The company said its goal is to help defenders discover and fix vulnerabilities before attackers can use them. It also stressed that automated patch generation and repeated security reviews will be important as model capabilities improve.

The findings were published by OpenAI as part of its Patch the Planet initiative.

Get the latest in engineering, tech, space & science - delivered daily to your inbox.

By subscribing, you agree to our

and

You may unsubscribe at any time.

0

COMMENT

Subscribe to

Today!

Access to exclusive content, expert insights and a deeper dive into engineering and tech. No ads, no limits.

By

With over a decade-long career in journalism, Neetika Walter has worked with The Economic Times, ANI, and Hindustan Times, covering politics, business, technology, and the clean energy sector. Passionate about contemporary culture, books, poetry, and storytelling, she brings depth and insight to her writing. When she isn’t chasing stories, she’s likely lost in a book or enjoying the company of her dogs.

• 1New zinc-ion batteries retain nearly 90% capacity after 10,000 charge-discharge cycles
• 2Drone that can travel faster than speed of sound to get major power boost with turbojet engines
• 3US nuclear reactors secure new fuel as Urenco ships first advanced uranium batch
• 4Nuclear fusion reactor gets massive 13-ton beam box to achieve 108 million °F
• 5First home-built hydrogen train with 435-mile range set to enter service in Russia

Key Takeaways

• OpenAI's pipeline identified 948 distinct Linux local privilege-escalation vulnerabilities after reproducing 1,724 candidate flaws.

• Researchers found at least 10 previously undocumented exploitation techniques in a sample of 166 exploits.

• The October campaign cost $1.21 million in API credits and found more than five times as many unique LPE vulnerabilities as a July run.

OpenAI has developed an automated cybersecurity research pipeline that identified 948 distinct Linux kernel vulnerabilities capable of allowing local users to gain root access, while uncovering at least 10 previously undocumented exploitation techniques.

The system analyzed thousands of potential security issues, reproduced vulnerabilities in controlled environments and generated working exploits and candidate patches for human review.

In a research post, OpenAI said the pipeline identified 2,308 candidate findings and dynamically reproduced 1,724 of them. It subsequently generated 1,169 working local privilege escalation (LPE) exploits, which variant analysis narrowed to 948 distinct vulnerabilities.

The mid-October 2026 campaign used an upcoming cyber model that the company has not yet publicly identified. The full run cost $1.21 million in API credits, averaging about $1,279 per distinct LPE vulnerability.

The research highlights how increasingly capable models could help security teams identify and fix flaws in critical software before attackers exploit them.

Automated security pipeline

OpenAI’s system followed a five-stage process covering vulnerability discovery, dynamic validation, exploitability assessment, patch generation and human review.

Scout agents first identified security-relevant sections of the Linux kernel, narrowing the audit to 5,034 targets covering about 2.8 million lines of code, or roughly 7 percent of the codebase.

More from AI and Robotics

Analyst agents then examined those targets and produced 2,308 candidate findings within 12 hours. The system attempted to reproduce each issue inside isolated virtual machines, confirming 1,724 vulnerabilities within 30 hours.

Exploit-development agents tested whether the validated flaws could expose information or enable local privilege escalation. The system produced 291 information-leak proofs of concept and 1,169 working LPE exploits.

Variant analysis identified 948 distinct vulnerabilities behind those exploits. The pipeline also generated candidate patches, with human security researchers reviewing the findings before they were reported to maintainers.

OpenAI said it had already sent hundreds of reports and patches for critical vulnerabilities, following guidance from the Linux kernel community. It is working with Patch the Planet partners to report and address additional issues.

New exploitation methods

The researchers sampled 166 exploits and found that theagentshad used at least 10 exploitation techniques that, to their knowledge, were previously undocumented. Third-party kernel exploitation experts consulted by the team also considered the techniques new.

These included methods for placing objects inside kernel memorycaches, improving exploit reliability and obtaining privilege escalation through data-only attacks.

The newer pipeline also showed a substantial increase over an earlier campaign. In July 2026, GPT-5.6 Sol found and exploited 166 unique LPE vulnerabilities at a cost of $513,690. The October run identified 948, more than five times as many, despite three months of additional kernel hardening.

OpenAI compared the 948 vulnerabilities with historicalLinuxkernel bug bounty payouts from Pwn2Own and TyphoonPWN. Applying those past rewards produced a hypothetical valuation of $18.9 million to $66.3 million, or 16 to 55 times the pipeline’s cost. This is an illustrative comparison, not actual bounty income.

The company said its goal is to help defenders discover and fix vulnerabilities before attackers can use them. It also stressed that automated patch generation and repeated security reviews will be important as model capabilities improve.

The findings were published by OpenAI as part of its Patch the Planet initiative.

Get the latest in engineering, tech, space & science - delivered daily to your inbox.

By subscribing, you agree to our

and

You may unsubscribe at any time.

0

COMMENT

Subscribe to

Today!

Access to exclusive content, expert insights and a deeper dive into engineering and tech. No ads, no limits.

By

With over a decade-long career in journalism, Neetika Walter has worked with The Economic Times, ANI, and Hindustan Times, covering politics, business, technology, and the clean energy sector. Passionate about contemporary culture, books, poetry, and storytelling, she brings depth and insight to her writing. When she isn’t chasing stories, she’s likely lost in a book or enjoying the company of her dogs.

• 1New zinc-ion batteries retain nearly 90% capacity after 10,000 charge-discharge cycles
• 2Drone that can travel faster than speed of sound to get major power boost with turbojet engines
• 3US nuclear reactors secure new fuel as Urenco ships first advanced uranium batch
• 4Nuclear fusion reactor gets massive 13-ton beam box to achieve 108 million °F
• 5First home-built hydrogen train with 435-mile range set to enter service in Russia