Hardware Ready Ready to Bench?
An automated pipeline developed by OpenAI, based on a new cybersecurity model, identified and reproduced 1,724 vulnerabilities in the Linux kernel, generating 948 working exploits to obtain root privileges. The operation cost $1.21 million in API credits and also produced potential patches, currently under review by researchers.
OpenAI developed an autonomous pipeline specifically designed to identify, verify, and prepare fixes for vulnerabilities present in the Linux kernel. In a single run, conducted in mid-October with a cybersecurity model not yet publicly released, the system was able to produce 948 working exploits capable of allowing an unprivileged local user to obtain root access.
OpenAI Linux kernel: why it matters
The total cost of the operation amounted to $1,213,430, calculated in API credits used to power the automated system. The detailed results were illustrated in a post on OpenAI’s blog, which describes the methodology employed, the costs incurred, and the capabilities demonstrated by the system.
According to OpenAI, the most significant aspect does not lie solely in the high number of vulnerabilities identified, but in the concrete possibility of automating a considerable portion of the entire process. This includes the initial source code analysis, the reproduction of detected issues, the assessment of their exploitability and, finally, the generation of corrective patches.
The Linux kernel represents a particularly interesting target for this type of research due to its size and complexity. With over 40 million lines of code, it constitutes the fundamental core of operating systems and infrastructure used in a wide range of applications, from Android smartphones to cloud servers, passing through supercomputers.
Its architecture presents a broad attack surface that includes system calls, network features, file system management, and hardware drivers, making complete and exhaustive analysis complex. The identified vulnerabilities predominantly belong to the Local Privilege Escalation (LPE) category.
LPEs are defects that can allow a user with limited privileges to obtain higher permissions, up to the root level. It is important to note that exploiting an LPE vulnerability requires the presence of a user account or the ability to execute code on the target machine.
The pipeline’s operation is articulated in five distinct phases, each entrusted to specific groups of AI agents with well-defined tasks. The first phase is dedicated to code reconnaissance: Scout agents identified 5,034 areas of the kernel that warranted more in-depth control, analyzing approximately 2.8 million lines of code in total, corresponding to about 7% of the entire project.
This initial phase incurred a cost of $3,426 in API credits. Subsequently, Analyst agents examined the selected areas, identifying 2,308 potential vulnerabilities in just 12 hours. The cost of this activity was significantly higher, reaching $316,549.
However, simply reporting a potential vulnerability does not necessarily imply its actual exploitability. For this reason, OpenAI introduced a dynamic validation phase. Triage agents generated proof of concept (PoC) programs, i.e., minimal programs designed to reproduce the anomalous behavior, executing them in isolated virtual machines.
These virtual machines used a kernel instrumented with KASAN (Kernel Address Sanitizer), a tool that allows detecting illegal memory accesses. In 30 hours, Triage agents were able to reproduce 1,724 vulnerabilities, equal to 74.7% of the initial reports.
OpenAI highlights that only 3.1% of unvalidated candidates resulted from an erroneous analysis by the AI model, which had hypothesized impossible conditions. The other cases were not confirmed primarily due to the need for elevated privileges, the difficulty in reproducing certain race conditions, or the lengthy verification procedures required.
The validation phase incurred a cost of $73,330. The fourth phase focused on assessing the potential impact of the vulnerabilities, at a cost of $44,194. A selection agent reduced the number of candidates to 313 potential information leak vulnerabilities and 1,238 possible LPEs.
ExploitDev agents then attempted to exploit these vulnerabilities in virtual machines configured with standard protections present in Linux distributions, including SMEP, SMAP, KASLR, and HARDENED_USERCOPY. These security measures make kernel compromise and memory manipulation more difficult.
The system managed to generate 291 working proof of concepts for information leak vulnerabilities and 1,169 LPE exploits. The final number of 948 derives from an analysis aimed at grouping exploits that referred to the same underlying vulnerability. After eliminating duplicates, OpenAI identified 948 distinct LPEs and prepared an equal number of candidate patches.
The most expensive phase of the entire process was exploit development, which absorbed about 64% of the total budget ($775,929). On average, creating a successful LPE exploit cost approximately $360 in API credits. Unsuccessful attempts were significantly more costly, with 69 cases requiring a total of approximately $3,922 each.
OpenAI clarified that the main objective of the research was to measure the AI model’s capabilities, not to optimize costs. The indicated expenditure therefore represents an upper limit, which could be reduced by intervening on agent organization and validation procedures.
The 948 identified vulnerabilities were associated with correction proposals, but this does not mean that all patches have already been accepted by the Linux kernel development maintainers. OpenAI followed the Linux community’s guidelines, starting from the vulnerabilities considered most critical.
Hundreds of reports and related patches have already been sent to maintainers, while for others the company is collaborating with partners of the Patch the Planet initiative, part of the Daybreak program dedicated to open source software security. Meanwhile, the Linux community continued its work autonomously.
According to data collected by OpenAI, in the ten days required to complete the scan and manual analysis, 61 LPE vulnerabilities were already fixed in the main kernel branch, another 43 had patches in preparation, and 299 were subject to public reports and discussions. This highlights an operational issue: automatically generated reports must be compared with the latest code to avoid sending maintainers already-fixed vulnerabilities or duplicates of issues identified by other researchers.
What changes and what are the effects
Human review therefore remains an essential component of the process. OpenAI also discovered a problem in its verification process: during an initial run, the system had declared 200 LPE exploits successful, but 20 of these had obtained root privileges by exploiting a different zero-day vulnerability than the one assigned to the agents.
The company subsequently introduced independent controls to ensure that each exploit actually uses the defect indicated in the report. The research also offers a comparison with the capabilities of previous models. At the end of July, GPT-5.6 Sol had identified and exploited 166 unique LPE vulnerabilities, at a total cost of $513,690.
The new mid-October campaign reached 948, surpassing the previous result by more than five times, despite the kernel having received numerous fixes in the meantime. The average cost per vulnerability dropped from approximately $3,100 to $1,279.
Another relevant element concerns the need to provide the model with specific instructions and tools for exploit development. In tests with GPT-5.5 Cyber, OpenAI had collected 103 exploitation techniques in a format easily usable by agents. On 63 candidates, this integration raised the success rate from 76.2% to 88.9%. With GPT-5.6 Cyber, however, the model proved more autonomous in identifying and applying necessary techniques.
Without the additional orchestration layer, it achieved a success rate of 92.1%, rising to 93.6% by reinserting predefined techniques. The improvement of just 1.5 percentage points did not justify, according to OpenAI, the increased system complexity. Agents also demonstrated they could develop previously undocumented approaches.
Analyzing a sample of 166 exploits, researchers identified at least ten new exploitation techniques that were unknown even to external experts consulted by the company. Two concern new persistent objects used to fill kernel caches, two new memory page management techniques, five methods based on data manipulation, and an approach exploiting type confusion. OpenAI did not publish technical details to avoid facilitating potential offensive activities.
To assess the technology’s potential, OpenAI compared its pipeline costs with prizes historically offered by some security competitions. Pwn2Own and TyphoonPWN have previously recognized $20,000 and $70,000 respectively for Linux kernel LPE exploits. Applying these amounts to the 948 exploits developed by the system yields a theoretical valuation between $18.9 million and $66.3 million.
This is a value 16 to 55 times higher than the campaign cost, although it does not represent actual revenue nor imply that all vulnerabilities would have been accepted by bug bounty programs. A second test involved Google’s kernelCTF, a program using a version of the kernel with a reduced attack surface.
In this environment, the pipeline produced 25 proof of concepts for information leaks and 21 LPE exploits, employing a total of 112 hours and $32,936 in API credits. In 2026, at the time of the report’s publication, kernelCTF had accepted 26 zero-day LPE exploits. If all 21 vulnerabilities identified by OpenAI had been admitted to the program, they could have generated prizes for approximately $1.5 million, about 45 times the research cost.
During this second campaign, agents also identified a vulnerability in the QEMU TCG emulator used for testing. The problem was reconstructed without agents accessing QEMU’s source code and was subsequently exploited to achieve local privilege escalation. Manual analysis verified that the defect had already been fixed in the project’s main branch but not in the version used in the experiment.
OpenAI’s conclusions directly concern Linux system management. According to the company, in the short and medium term, an account with limited privileges on an unpatched system should be considered, under certain conditions, substantially equivalent to root access for a resourceful attacker. The risk is particularly relevant in environments where multiple users or applications share the same infrastructure, such as hosting, servers, continuous integration runners, and hosts running containers.
In these contexts, an LPE vulnerability can allow an aggressor who has already obtained limited access to compromise the entire machine. To reduce the consequences of a potential exploit, OpenAI indicates the importance of promptly updating the kernel, limiting code execution on sensitive machines, and using isolation systems like Firecracker and gVisor.
Patch installation must also be followed by a system reboot, when necessary, for the correct kernel to actually be loaded. The research also highlights the need to repeat scans periodically. More advanced models can identify defects missed by previous generations and, in complex projects, multiple iterations of analysis and correction may be required to progressively reduce the number of remaining vulnerabilities.
Source and further reading on OpenAI Linux kernel: original article.
* Content created with the assistance of artificial intelligence systems.