OpenAI's autonomous pipeline found 1,724 Linux kernel bugs and wrote 948 root exploits

OpenAI published “A thousand fewer paths to root” on November 4: an autonomous vulnerability-discovery pipeline, driven by the company’s unreleased cyber model, scanned the Linux kernel and turned 2,308 candidate findings into 1,724 dynamically reproduced vulnerabilities and 948 working local privilege escalation (LPE) exploits — plus 291 information-leak PoCs — for $1,213,430 in API credits, about $1,279 per exploit. Ten days after OpenAI reported the findings to the kernel community, 61 of the LPEs were patched upstream. The Hacker News thread (story 50372929) stood at 391 points and 277 comments as of midday UTC on November 5, with the pipeline’s author answering questions in person. It is the first time an AI exploit-discovery run has published its full ledger — findings, exploits, patches and cost — end to end.

Key points

• The 948 exploits map one-to-one to 948 candidate patches. The pipeline’s author confirmed on HN that counting goes by deduplicated patch, so the raw exploit count is higher — variant analysis folds same-root variants into a single patch — and the scope covers kernel code only.
• At least 10 exploitation techniques were confirmed as previously unknown by third-party kernel exploitation experts: 2 persistent elastic objects, 2 page-grooming techniques, 5 data-only escalations and 1 arbitrary type confusion. Their technical details are withheld, so the “new” claim cannot be checked from outside.
• OpenAI prices the same 948 LPEs at $18.9M–$66.3M on bug-bounty reference rates (Pwn2Own pays about $20K per exploit, TyphoonPWN about $70K) — 16x to 55x the $1.2M API cost.

Background

This is OpenAI’s second kernel scan, and the delta is the story. The previous run, on the earlier cyber model, found 166 LPEs for $513,690; this one found more than five times as many even though the kernel absorbed three months of upstream fixes between the two scans — the comparison Phoronix led with. Anthropic published a close cousin at the end of October: an unreleased Claude model autonomously found 62 Chrome CVEs and chained five working exploits (see Claude found 62 Chrome CVEs and chained five exploits). The run also puts a number on what IEEE Spectrum’s PHP2Shell analysis argued earlier this month: AI weaponizes dormant bugs faster than fixing can keep up. The UK’s NCSC had already assessed, as The Hacker News re-quoted, that AI tools have “almost certainly” increased zero-day discovery significantly.

The facts

The pipeline runs in five stages, and the report gives numbers for each. Scout agents pick audit targets that are security-relevant and reachable by a low-privileged user: 5,034 targets this run, about 2.8 million lines, roughly 7% of the kernel. Analyst agents scan statically and produced 2,308 candidates in 12 hours. Triage agents then reproduce each candidate in isolated KASAN-enabled VMs — 1,724 confirmed in 30 hours (74.7%), while 3.1% of candidates turned out to be misanalysis. A screening agent grades exploitability, then ExploitDev agents write exploits in VMs with SMEP, SMAP, KASLR and HARDENED_USERCOPY all enabled; success means a root shell. A patch stage generates candidate patches with variant analysis, and humans review exploit, patch and severity before anything goes to the kernel community. Ten days in: 61 patched upstream, 43 with staging patches, 299 publicly discussed.

Item	Value
Candidate findings (deduplicated)	2,308
Dynamically reproduced	1,724 (74.7%)
LPE exploits / info-leak PoCs	948 / 291
Total API cost	$1,213,430
Cost per LPE exploit (fully loaded)	about $1,279
Average cost, success / failed exploit	about $360 / about $3,922
Exploitation stage cost	$775,929
kernelCTF comparison	21 LPEs, 112 hours, about $32,936

Two disclosures beyond the headline numbers. First, a self-reported failure: in one batch of 200 claimed exploits, 20 actually leveraged a different vulnerability than the one assigned — the wrong 0-day — which OpenAI fixed by tightening constraints and adding independent checks, distilled as “verify the path to a result in addition to verifying the result itself.” Second, the operational claim worth quoting verbatim: a low-privileged account on a system that is not up to date on patches “should be considered functionally equivalent to root access for a well-resourced threat actor.” The report also concedes the cost figures are “more an upper bound” — the methodology was not tuned for cost.

What others say

The pipeline’s author, posting as ky1ebot1337 on HN, supplied the calibrations: all 948 are kernel bugs (userspace running as root was out of scope), the goal is a “vuln-free Internet,” and the plan is to rescan Linux with every new model generation as compute allows. The skepticism is just as specific. BoppreH called the result “bittersweet, like finding asbestos in your house.” kccqzy observed that LPEs are now so routine that “people no longer use low-privilege user accounts to sandbox potentially malicious software.” bombcar argued multi-user security “died in the 90s”; tptacek pushed back that it “didn’t ‘die’ in the sense that we gave up on it; it just never worked.” amluto, a former handler of nonpublic kernel security reports, asked for the public list and noted that almost none of the kernel bugs he has found were memory-safety errors — exactly the breakdown the report does not yet give. Phoronix’s Michael Larabel quoted the report’s own horizon: within a few years, “if there are vulnerabilities in a given software project, frontier models will likely be able to discover them.” The Hacker News added industry scale: GTIG counted monthly vulnerability disclosures rising from 5,045 in January 2026 to 10,740 in August, with high-risk ones up from 131 to 350.

Our take

For anyone running Linux, one conclusion here is hard: the patch window has changed. Sixty-one fixes in ten days upstream does not mean they are in your distro’s packages, and the threat model for low-privileged accounts — multi-tenant hosts and shared build machines first — needs to be re-priced at “roughly root.” Of OpenAI’s defense list (automated patch generation, defense in depth, rescanning as models improve), the actionable item today is shrinking the attack surface: sandbox boundaries like gVisor and Firecracker now have a price reference, because escaping them costs far more than $1,279. Three caveats belong in the same paragraph. Every number comes from OpenAI’s own environment; the 10 novel techniques are unpublished, so “novel” is unverifiable from outside; and how much these findings overlap Sashiko — the Linux Foundation side’s per-commit AI reviewer, credited with 191k patch reviews in a Phoronix piece the same day — went unanswered on HN. This is the same line as OpenAI’s red team finding the Brotli RCE: capability arrives first, the verification machinery trails.

What to watch

The author has committed to rescanning with each model generation, and Patch the Planet, a Daybreak initiative, is extending the find-and-patch loop to other critical projects. How many bugs remain is unknown — the author’s own yardstick is that nobody guessed at 900 more after the first scan found 166, and the same question now restarts at 948; OpenAI’s proposed answer is a benchmark built from a formally proven safe program with synthetic bugs injected. Two signals you can check yourself: how fast these patches land in the kernel mailing list threads, and what the next model’s rescan counts to.