Source: Unite.AI
OpenAI reported on November 4, 2026 that a prototype pipeline using an upcoming cyber model found and exploited 948 unique local privilege escalation vulnerabilities in Linux during a mid-October 2026 research run, while also generating candidate patches for maintainer review.
The flaws could give an unprivileged local user root access. Testing took place in isolated virtual machines running a stock desktop operating system with SMEP, SMAP, KASLR and HARDENED_USERCOPY enabled, rather than a deliberately weakened target. OpenAI chose Linux because the kernel contains more than 40 million lines of code and underpins Android devices, cloud infrastructure and supercomputers, providing a test of automated research against a codebase of that scale and importance.
From Candidate Findings To Working Exploits
The pipeline connects vulnerability discovery, dynamic validation, exploitability assessment, patch generation and human review. Scout agents select code based on its reachability by low-privileged users and security relevance, after which Analyst agents scan the targets. Triage agents generate and refine proofs of concept inside virtual machines running kernels with Kernel Address Sanitizer, preserving runtime evidence rather than relying solely on static analysis. Each completed research bundle contains a root-cause analysis, a minimal crashing proof of concept, a candidate patch and a full exploit.
OpenAI said the Scouts selected 5,034 audit targets covering about 2.8 million lines, roughly 7% of the kernel. Analysts produced 2,308 deduplicated candidate findings within 12 hours, and dynamic validation reproduced 1,724 vulnerabilities within 30 hours. Most remaining findings required elevated privileges or could not be reproduced within the time budget; only 3.1% reflected incorrect model analysis.
The exploit stage produced 291 information-leak proofs of concept and 1,169 working local privilege escalation exploits, according to OpenAI. Variant analysis then produced 948 distinct patches, and OpenAI uses that figure as the number of unique LPEs, explaining why the vulnerability total differs from the raw exploit count. The generated fixes remain candidates for maintainer review; the 948 figure is not a count of merged patches.
Human Review And Patch Status
OpenAI has sent hundreds of reports and patches for critical vulnerabilities and plans to distribute the remainder gradually with Patch the Planet partners. OpenAI introduced the Daybreak initiative with Trail of Bits on June 22, 2026, pairing AI-assisted research with expert review while maintainers retain control over patch deployment and disclosure. The earlier announcement reported 24 LPE exploits and eight kernel-pointer information-leak proofs of concept from its GPT-5.5 Cyber Linux work.
After finding 61 LPEs already patched upstream, 43 with staging patches and 299 being publicly reported or discussed at the end of the ten-day scan and manual analysis, OpenAI recommended revalidating findings against current code, including later merges, to avoid duplicate or obsolete reports. The goal is to focus maintainers on unresolved vulnerabilities without adding unnecessary review burden.
Review also caught a failure that a root shell alone would have hidden. In an early run, OpenAI said 20 of 200 reported successful exploits obtained root through a different 0-day than the assigned vulnerability, after which it tightened task constraints and added an independent check of each exploit’s path. Early directly prompted patches could be functionally correct while containing unnecessary code, potential performance tradeoffs, departures from coding conventions or incomplete variant coverage. Additional instructions and iteration improved patch quality, while human researchers still review the exploit, patch and proposed severity before reporting to maintainers.
Model Comparison And Test Costs
OpenAI’s comparison puts the mid-October run at $1.213 million in API credits, or $1,279 per unique LPE, against 166 unique LPEs and $513,690 for a late-July 2026 GPT-5.6 Sol run. Both scanned the latest Linux kernel master branch available at the time. The reported more-than-fivefold increase in novel LPEs came despite three months of hardening between scans. The costs are presented as upper bounds because the research focused on methodology and capability measurement rather than cost optimization.
OpenAI said a sample of 166 exploits contained ten techniques that both its team and third-party kernel exploitation experts believed were new, spanning persistent elastic objects, page grooming, data-only privilege escalation and arbitrary type confusion. Full technical details were withheld for safety reasons.
An adapted kernelCTF run produced 25 information-leak proofs of concept and 21 LPE exploits over 112 hours at roughly $32,936 in API credits, OpenAI reported. The tested kernel was incompatible with the SLAB_VIRTUAL mitigation, so OpenAI removed it from the configuration. The roughly $1.5 million bounty figure is conditional on all 21 vulnerabilities being accepted, rather than an announced award. Google’s kernelCTF rules list a $71,337 reward per eligible exploit, require at least 70% stability across 20 runs and limit rewards to qualifying 0-day submissions.
The results move the bottleneck from generating leads to proving exploit paths, keeping findings current and producing acceptable fixes. That makes independent verification and maintainer review central to whether automated research at this scale becomes usable defensive work rather than an additional reporting burden.
