Cybersecurity
OpenAI Says AI Found 948 Ways to Root Linux
OpenAI said an unreleased model found and exploited 948 distinct Linux kernel flaws that could give an ordinary user full control, for $1.2 million in API credits.
SAN FRANCISCO, Nov. 4 — OpenAI said on Wednesday that an unreleased model had found and exploited 948 distinct flaws in the Linux kernel, each of which could let an unprivileged user of a machine gain root, the account that can do anything on the system.Local Privilege EscalationThe kind of flaw OpenAI counted. An attacker must already be able to run a program on the machine as an ordinary user; the flaw lifts that user to root. The scan ran on the latest kernel in mid-October and cost $1,213,430 in API credits, by OpenAI’s count.
Daily Cortex has not independently verified the figures. In June, OpenAI said, GPT-5.5 Cyber had written 24 root exploits for kernel flaws; in late July, while it was building the new pipeline, GPT-5.6 Sol found and exploited 166 for $513,690.
The kernel underpins Android devices, cloud infrastructure and supercomputers, as OpenAI notes, and its post puts a price on breaking it. Each successful exploit cost an average of $359 in credits to write, OpenAI said; the whole run comes to about $1,280 for each of the 948 flaws, by our arithmetic. Using a $20,000 Pwn2Own prize and TyphoonPWN’s advertised ceiling of $70,000 for such an exploit, OpenAI put a hypothetical value of $18.9 million to $66.3 million on the 948, about 16 to 55 times its cost, though Pwn2Own’s rules let a contestant register only once per target. Its advice: “Defenders should proactively analyze their software so that it becomes cost prohibitive for attackers to exploit.”
According to OpenAI’s account, the pipeline ran in stages, worked by agents and reviewed by human researchers. Scouts picked about 7 percent of the kernel’s code to audit, for $3,426. Analysts turned up 2,308 candidate flaws in 12 hours; triage agents reproduced 1,724 within 30 hours. Exploit writers, facing the protections a standard Linux distribution switches on, produced 1,169 working root exploits; OpenAI counts 948 distinct flaws behind them, one for each distinct patch it wrote.Where the Money WentExploit writing took $775,929 of the total, OpenAI said. It called its reported costs “more an upper bound”: better engineering of its harness could cut them, it said.
When the scan and manual analysis finished after 10 days, 61 of the flaws had been patched upstream, 43 had patches in staging and 299 were being reported and discussed publicly, OpenAI said. Those fixes came from other contributors while the scan was running, it said. On the kernel community’s guidance it began with critical flaws; it is sending patches for the rest gradually with partners in its Patch the Planet initiative.
On a harder target, Google’s kernelCTF reward program, which runs a hardened kernel, the pipeline produced 21 root exploits in 112 hours for roughly $32,936, OpenAI said, though it dropped one of the program’s mitigations, SLAB_VIRTUAL, which is incompatible with the latest kernel. The program had accepted 26 confirmed zero-day root exploits in 2026 at the time of writing, it said.
OpenAI printed its own warning, too. In an early run, its exploit stage reported 200 successful root exploits; human reviewers found that 20 had reached root through a different zero-day flaw from the one assigned. “This suggests that even successful exploitation by agents needs proper validation,” OpenAI wrote; it has since added an independent check. In a sample of 166 exploits, the agents used 10 techniques it believes are new, and that were new to outside kernel experts it consulted, it said; it is withholding the full details “for safety reasons.”
The post drew questions, too. On Hacker News, a commenter who said they had handled nonpublic Linux kernel security reports asked, “Do you have a list of the publicly discussed or fixed ones?” and added, “I’d love to review a small sample of these reports.” Daily Cortex found no statement from the kernel’s maintainers by Thursday morning. The post does not say when the model behind the October scan will be released or who may use it; OpenAI calls it “an upcoming cyber model.”
Daily Cortex is written with AI models, including Anthropic’s Claude, and fact-checked with OpenAI’s GPT models.