OpenAI agents found 948 Linux kernel root exploits for $1.2 million

A normal user account on a Linux box without the latest patches should now be treated as root. OpenAI says its agents ran in a controlled lab. In one scan they wrote 948 working local root exploits for a stock Linux desktop. The API cost was $1,213,430, which is $1,279 for each root exploit.

OpenAI published the run on 4 November 2026. A pipeline of agents, driven by an upcoming cyber model, works on the kernel in five stages. The agents find candidate bugs. They reproduce them in a sandbox. They check if a bug can give a user root. They write a patch. A human reviewer then reads the result. The run produced 2,308 candidate findings. It reproduced 1,724 of them. Of those, 948 gave full root and 291 leaked information.

The numbers OpenAI reports

OpenAI compares the cost to older bug bounties at Pwn2Own and TyphoonPWN. Those contests paid $20,000 and $70,000 for a Linux kernel root exploit. On those older prices, the 948 exploits would be worth $18.9 million to $66.3 million. OpenAI says the pipeline is 16 to 55 times cheaper than paying for the same bugs one by one.

A smaller run went against a harder kernel build used by Google's kernelCTF. That run produced 21 root exploits and 25 information leaks. It cost $32,936 in API credits. OpenAI says kernelCTF would pay around $1.5 million for 21 accepted exploits, which is about 45 times the scan cost. For comparison, kernelCTF has accepted 26 confirmed zero-day root exploits in all of 2026 so far.

The agents also found at least ten new ways to turn a kernel bug into root access, by OpenAI's count.

What the Linux side did

OpenAI followed the Linux community's guidance and started reporting the worst bugs first. It worked with the Patch the Planet partners on the reports. While the scan ran, other people patched more than 100 Linux root bugs in ten days. Some bugs got draft patches. Around 300 more were being discussed in public. So the raw count OpenAI reports is already out of date. The real number of open holes is smaller.

The company also flags a limit on its own number. The scan ran on a stock desktop Linux build. It did not run on a hardened production server. A server with SELinux in enforcing mode may still block some of these exploits. A sandboxed workload may block them too. The bug can be present and the attack still fail.

What a team should take from this

OpenAI's lesson from the run is short. For now, treat a low-privilege Linux account on a box behind on patches as if the attacker has root. A well-funded group can find and chain these bugs at this cost. The defence is to keep the blast radius small. Use sandboxes, Firecracker, gVisor, and other isolation layers. That way a root hole on one workload does not reach the whole box.

This is also the first large study of a working auto-patch pipeline. OpenAI says patch generation has to catch up with vulnerability discovery. The pace of discovery with frontier models is faster than the pace of fixing. With human review, OpenAI says AI-written patches can be correct and match the kernel's style. The company calls this open work worth doing.

Source

• A thousand fewer paths to root, OpenAI