OpenAI said an autonomous agent pipeline running an upcoming, unreleased cyber model built 948 unique local root exploits against the Linux kernel in a single run, at a total cost of $1,213,430 in API credits. OpenAI laid out the results in a new research post titled "A thousand fewer paths to root."
The pipeline started from 5,034 targets covering about 7% of the kernel, or roughly 2.8 million lines of code. Agents flagged 2,308 candidate findings, reproduced 1,724 of them, a 74.7% hit rate, and turned those into 948 distinct paths to root. The target was the latest kernel master branch as of mid-October 2026.
Exploitation was the most expensive stage at $775,929, followed by discovery at $316,549 and triage at $73,330. Spread across the full run, the bill works out to roughly $1,280 per working root exploit. OpenAI described its cost figures as an upper bound.
Key facts
- 01OpenAI's pipeline produced 948 unique local root exploits against the Linux kernel in one run.
- 02The run cost $1,213,430 in API credits, roughly $1,280 per root exploit.
- 03Of 2,308 candidate findings, 1,724 (74.7%) were reproduced.
- 04Ten days in, 61 fixes were upstream, 43 staged and 299 under public discussion.
- 05OpenAI says the agents used at least 10 novel exploitation techniques it is not publishing.
OpenAI also priced the output against the open market. Using bounty rates of $20,000 to $70,000 per kernel root exploit at contests such as Pwn2Own and TyphoonPWN, the company put the hypothetical value of the haul at $18.9 million to $66.3 million, 16 to 55 times what the run cost.
The agents did not just reuse known tricks. "To the best of our knowledge, the agents in this pipeline discovered and used at least 10 novel Linux exploitation techniques," OpenAI wrote. The company is not publishing those techniques. Reported methods in the run include elastic-object cache sprays, page grooming, type confusion and several data-only root attacks, and a syscall-auditing agent also surfaced a crash in QEMU's TCG emulator.
OpenAI ran a separate test against the kernelCTF environment. Over 112 hours and $32,936, the pipeline produced 25 information leaks and 21 root exploits, with an estimated bounty value of about $1.5 million, roughly 45 times the cost.
Findings and candidate patches go to human researchers before anything reaches kernel maintainers, through partners in OpenAI's Patch the Planet program. That effort launched in June 2026 with Trail of Bits, HackerOne and Calif. Ten days in, 61 fixes had landed upstream, 43 were staged and 299 were under public discussion. OpenAI said it started with the most critical bugs on the advice of the kernel community.
The jump in scale is steep. A June run on GPT-5.5 Cyber produced 24 root exploits, and a July run with GPT-5.6 Sol found 166 flaws for $513,690.
The authors warned that an unpatched local user account is now "functionally equivalent to root access for a well-resourced threat actor," and argued that "automated patch generation is essential to secure software at the pace required, and to limit the exploitation window."
OpenAI's own read on the bottleneck: "Vulnerability discovery is becoming easier to scale, but prioritization and validation remain operational bottlenecks."
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
