OpenAI Agents Find 948 Linux Kernel Root Flaws in One Run, Each With a Working Exploit and Patch

What happened

The pipeline has five stages: Scout agents first picked 5,034 audit targets covering about 2.8 million lines of code, roughly 7% of the kernel; Analyst agents produced 2,308 candidate findings within 12 hours; triage agents reproduced 1,724 of them in isolated virtual machines, about 74.7%, with the rest mostly needing higher privileges or failing to trigger within the time budget, and only 3.1% counted as model analysis errors; exploit-development agents tested the strongest candidates in virtual machines with a standard distribution's protections switched on, producing 1,169 working local privilege escalation exploits and 291 information-leak proofs of concept; grouping by patch gave 948 distinct vulnerabilities, each with a candidate patch. The work comes from OpenAI's Cyber team under its Patch the Planet program, built on an upcoming cyber model that has not been released, with human review as the final step.

The cost and the scale of progress were published together. The full run cost $1,213,430 in API credits, with exploit development taking $775,929; a successful exploit cost $359 on average, while failed attempts averaged $3,922, and the company says the cost figures are more an upper bound than a tuned price. In July, GPT-5.6 Sol ran the same pipeline and found 166 distinct privilege escalation flaws for $513,690, and in June GPT-5.5 Cyber found only 24. Priced against past contest payouts, the 948 exploits would be worth $18.9 million to $66.3 million, 16 to 55 times the run's cost. The pipeline was also tested on Google's hardened kernelCTF kernel: 21 privilege escalation exploits and 25 information-leak proofs of concept in 112 hours for $32,936.

The human review stage left the key detail. An early run reported 200 successful exploits, and human review found that 20 of them had reached root through a different 0-day vulnerability than the one assigned; the team then tightened the task constraints and added an independent check confirming that each final exploit used its assigned vulnerability. A sample of 166 exploits used 10 exploitation techniques the researchers had not seen documented before, with details withheld for safety reasons. Ten days after the scan finished, 61 of the flaws had already been patched upstream, 43 had patches in staging, and 299 were being reported and discussed in public; hundreds of reports and candidate patches for critical flaws have been sent to maintainers following the kernel community's guidance. The post names no CVE identifiers, affected kernel versions or subsystems, and candidate patches become real fixes only when maintainers accept them. OpenAI also warns that on an unpatched system, a low-privilege account is functionally equivalent to root for a well-resourced attacker.

Key facts

1. Publisher and date: OpenAI's Cyber team, Nov 4, 2026, in the research post "A thousand fewer paths to root"
2. Headline numbers: 2,308 candidate findings, 1,724 reproduced (about 74.7%), 1,169 working local privilege escalation exploits and 291 information-leak proofs of concept, 948 distinct vulnerabilities each with a candidate patch
3. Scope: Scout agents picked 5,034 audit targets, about 2.8 million lines of code, roughly 7% of the kernel
4. Cost: $1,213,430 in API credits for the full run, $775,929 for exploit development, $359 per successful exploit on average; the company says the figures are more an upper bound
5. Progress: GPT-5.6 Sol found 166 in July for $513,690, and GPT-5.5 Cyber found only 24 in June
6. Valuation: priced against past contest payouts, the 948 exploits would be worth $18.9 million to $66.3 million, 16 to 55 times the run's cost
7. Review: an early run reported 200 successful exploits, and human review found 20 had reached root through a different 0-day than the one assigned; the team tightened the task and added an independent check
8. New techniques: a sample of 166 exploits used 10 exploitation techniques the researchers had not seen documented before, with details withheld for safety reasons
9. Patching progress: 10 days after the scan, 61 flaws had been patched upstream, 43 had patches in staging, and 299 were being reported and discussed in public
10. Open items: the post names no CVE identifiers, affected kernel versions or subsystems; candidate patches become real fixes only when maintainers accept them