OpenAI Cyber Model Found 948 Linux Kernel Exploits in One October Run

A single automated run by OpenAI’s cyber model found 948 working Linux kernel exploits in mid-October 2026 — every one of them lifting an unprivileged local user to root on a stock desktop distribution. As disclosures of Linux kernel exploits go, it is the largest machine-generated haul ever documented.

The effort belongs to OpenAI’s Patch the Planet initiative, part of the company’s broader Daybreak commitment to open-source security. What separates this disclosure from a teaser is the bookkeeping: OpenAI published stage-by-stage counts, validation rates, failure modes, and the full API bill for the campaign.

The money line reads like venture math. The run cost $1,213,430 in API credits, or $1,279 per finished exploit, and the same haul of Linux kernel exploits carries a hypothetical contest-bounty value of $66.3 million — a 16-to-55 times multiple, before OpenAI’s own claim that better harness engineering could shrink the bill.

This article unpacks what the five-stage pipeline actually did, why the kernel community responded by patching 61 of the found flaws within ten days, and what OpenAI’s closing warning means for anyone who runs Linux on anything they care about. Every number below comes from OpenAI’s published research on the Linux kernel exploits campaign, so the claims can be checked against the disclosure rather than taken on faith.

The numbers came from OpenAI’s own write-up, covered in detail by AI News. A five-stage research system, running on an upcoming cyber model, produced 948 working local privilege escalation exploits in one October run. Every finished exploit takes an unprivileged local account to root on a stock desktop distribution — no weakened test builds, no disabled defenses. Context matters: 948 Linux kernel exploits in a single disclosed run dwarfs any previous automated security audit in the wild, and it lands as the same models are being pointed at other open-source projects under the Daybreak program.

The system flagged 2,308 deduplicated candidate findings on the latest Linux kernel master branch. Nothing reached maintainers unsupervised: human security researchers reviewed every exploit, every patch, and every severity rating before it was reported. The campaign began with critical vulnerabilities under Linux kernel community guidance, and hundreds of reports and patches have already gone upstream.

That supervision requirement is worth repeating: the pipeline manufactured the Linux kernel exploits at machine speed, but a human being signed off on each one before a maintainer ever saw it. It is also a working preview of how Linux kernel exploits will keep arriving from here on: quietly, in bulk, and with a patch series racing to catch them.

Each of the 948 wins is a reproducible path from an ordinary user account to full root — the kind of local privilege escalation chain that has historically been worth real money at Pwn2Own and TyphoonPWN. The targets ran with SMEP and SMAP enabled alongside KASLR and HARDENED_USERCOPY, the same threat model those contests use, which is what makes the haul so hard to wave away as toy results. A researcher who wants to dismiss AI-found bugs usually starts here, and this is the paragraph that ends that argument: the same chains would score at a contest, against the same mitigations, on the same class of machine.

The run even surfaced a QEMU TCG vulnerability in the testing harness itself, traced without any access to QEMU source code. The bug had already been fixed upstream — but the fix was missing from the release build under test, a quiet reminder that even the sandboxes security research runs inside are made of software. It also underlines how thorough the sweep was: the agents found a hole in the furniture while hunting for Linux kernel exploits, and reported that one upstream as well.

Not everything the agents proposed was real. Only 74.7 percent of the exploit candidates survived dynamic validation — the stage that actually executes a proof of concept and demands a crash. The failures clustered around privilege requirements, race conditions, and fault-injection dependencies rather than model error. Straight-up model error accounted for just 3.1 percent of the failures.

That distribution matters more than any headline number. The pipeline’s mistakes were mostly environment mistakes — the agent believed a chain needed privileges the test account did not have, or raced a window that the harness never opened. Those are harness problems, and harness problems are cheap to fix. Cheap to fix is uncomfortable for defenders: it means the gap between a 74.7 percent validation rate and a 90 percent one is an engineering sprint, and the next generation of Linux kernel exploits will arrive with fewer false starts attached.

OpenAI audited its own scoreboard hard. An early run logged 200 successful exploits by the system’s own count. Human reviewers went back through every single one and found 20 exploits had gained root through a different 0-day than the one assigned to them. OpenAI tightened the task constraints and added an independent check tying each final exploit to its assigned bug. Nobody outside the company would have caught that 10 percent inflation, which is exactly why the audit exists before the count of Linux kernel exploits became public.

That 20-in-200 overcount would be a rounding error in most AI announcements. OpenAI published it, which is the disclosure equivalent of grading your own homework in red ink — and the reason the remaining 948 Linux kernel exploits are treated as solid by researchers who would otherwise ignore a vendor press release.

The full October campaign cost $1,213,430 in API credits, which works out to $1,279 for every working root exploit. Exploitation dominated the budget: building and validating the chains is where the tokens go. OpenAI casts the reported costs as an upper bound, arguing that harness engineering — smarter prompts, cheaper stages, fewer wasted retries — could cut spend at every step of the pipeline. At $1,279 a copy, a well-funded buyer could order thousands of bespoke Linux kernel exploits for the price of one mid-size enterprise contract — which is the real headline hiding inside the accounting.

The trajectory inside OpenAI’s own runs is just as steep. GPT-5.6 Sol, an earlier model, produced 166 of these exploits in a late-July run. The kernel tree had absorbed months of additional hardening by the time October arrived, and the newer cyber model still returned more than five times that count. Automation plus model progress plus a hardened target equals a curve nobody in open-source security wants to extrapolate casually. Each October run of Linux kernel exploits inherits every lesson from July, every hardened kernel release notwithstanding — hardening slowed the humans, but barely dented the machine.

And the incentive gradient is not academic. The same chains are the product — which is precisely why the disclosure insists human review gates every report, and why defenders rather than brokers hold the first copy. The threat side of this market already exists; infostealer malware that uses AI to “autodox” victims shows how quickly AI-assisted operators monetize any access they can get.

The agents did not just rediscover old tricks at machine speed. The disclosure says at least 10 exploitation techniques were confirmed new by third-party kernel experts who had spent careers studying this exact attack surface. Persistent elastic objects for cache spraying appear in the set. Page grooming for reliability does too. Data-only escalation paths and an arbitrary type confusion round out the named examples.

That is the first time an AI research pipeline has shipped exploitation primitives that the human expert community treats as additions to the craft, not just applications of it — a distinction that matters as much as the count itself, and one that echoes AI-discovered PHP security vulnerabilities that forced emergency patches across websites earlier this year. Experts who had spent decades cataloguing Linux kernel exploits now have a growing shelf of machine-invented techniques to add to the catalogue, and a new deadline problem: the library of known tricks is no longer finite.

The heaviest orchestration did not survive the model upgrades. A curated technique library lifted GPT-5.5 Cyber’s success rate from 76.2 percent to 88.9 percent — but GPT-5.6 Cyber beat both marks without the library, so OpenAI stripped the scaffolding from the pipeline entirely. The lesson generalizes far beyond security research: hand-built expert scaffolding is often a temporary tax paid on behalf of yesterday’s model. The technique library that once lifted exploit success by twelve points became dead weight the moment newer Linux kernel exploits arrived without it, which tells you how fast the ceiling on agentic security research is moving.

It is the same pattern OpenAI has been documenting across fields in OpenAI’s push to automate scientific discovery — the agentic harness matters less each generation, because the model increasingly supplies its own judgment.