Notes from Việt Nam on law, technology, languages, history, culture and travel.

948 Roads to Root for $1.2 Million: Inside OpenAI's Autonomous Linux Kernel Bug Pipeline

On 4 November 2026 OpenAI’s security team published a long write-up titled “A thousand fewer paths to root”. The claim in the subtitle is blunt: an autonomous pipeline built around an unreleased “upcoming cyber model” validated and generated patches for 948 local privilege escalation (LPE) vulnerabilities in the Linux kernel, in one run, for $1.2 million in API credits. An LPE is a bug that lets an ordinary, unprivileged user on a machine become root.

Phoronix picked the post up on 5 November, and Hardware Busters ran a detailed breakdown the same day. Both reproduce the same figures. What follows is drawn from OpenAI’s own post, read in full, with the secondary coverage used as a cross-check.

The five stages

The pipeline is a chain of specialised agents. Each stage passes a smaller, better-evidenced set of findings to the next.

1. Scouting. “Scout” agents walked the kernel tree and picked targets that are both reachable by a low-privileged user and security-relevant. They selected 5,034 audit targets, about 2.8 million lines, roughly 7% of a kernel that has more than 40 million lines. Cost: $3,426.

2. Analysis. “Analyst” agents read each target, worked out its threat model and looked for bugs, using a workflow OpenAI says resembles its open-source Codex Security plugin. In 12 hours they produced 2,308 deduplicated candidate findings. Cost: $316,549.

3. Dynamic validation. This is where the pipeline differs from a static analyser. For every candidate, a triage agent wrote a proof of concept and ran it in an isolated VM with a KASAN-instrumented kernel (the Kernel Address Sanitizer, which reports memory corruption as it happens). It kept refining the PoC until the bug reproduced or the agent ran out of ways to trigger it. In 30 hours, 1,724 candidates reproduced, 74.7%. OpenAI says only 3.1% of candidates were outright wrong analysis. Most of the others needed elevated privileges or depended on hard-to-hit races or fault conditions. Cost: $73,330.

4. Exploitability. A deliberately permissive screening agent ($44,194) narrowed the field to 313 information-leak and 1,238 LPE candidates. Then “ExploitDev” agents tried to weaponise them on VMs with the protections a normal distribution ships: SMEP, SMAP, KASLR and HARDENED_USERCOPY. They produced 291 info-leak PoCs and 1,169 working root exploits. Variant analysis collapsed those exploits onto 948 distinct patches, and that patch count is the headline number. This was by far the most expensive stage at $775,929. A successful exploit averaged about $360. The 69 failures averaged $3,922 each, mostly agents grinding on race conditions with no give-up rule.

5. Patches and human review. The system bundles a root-cause analysis, a minimal crashing PoC, a candidate patch and the full exploit for a human researcher, who decides severity and what to send upstream.

What is genuinely new

Automated kernel bug-finding is not new: syzkaller has been fuzzing Linux for years. Three things in this report go beyond it.

  • End-to-end exploitation at scale. Fuzzers find crashes. Turning a crash into a reliable root exploit against SMEP/SMAP/KASLR has traditionally been days or weeks of specialist work per bug, and Pwn2Own and TyphoonPWN have paid $20,000 and $70,000 respectively for one. OpenAI applies those bounties to the 948 bugs to get a hypothetical $18.9M–$66.3M, or 16–55 times the run’s cost. That comparison is illustrative, since no bounty was collected, but the direction is clear.
  • New techniques. In a sample of 166 exploits, OpenAI says the agents used 10 exploitation techniques that outside kernel-exploitation experts also considered new: heap-spray objects, page-grooming methods, data-only privilege-escalation tricks and a type-confusion approach. Details are withheld, so this cannot be checked independently.
  • A steep model-to-model curve. A late-July run with GPT-5.6 Sol found 166 unique LPEs for $513,690, about $3,100 each. The mid-October run found 948 for about $1,280 each. OpenAI says that is more than five times as many novel bugs, despite three months of kernel hardening between the scans. Against Google’s hardened kernelCTF target the pipeline produced 21 LPE exploits for about $32,936. For scale, kernelCTF had accepted 26 confirmed 0-day LPEs in all of 2026 at the time of writing.

Lessons for anyone building agents

Several of the “takeaways” are useful well outside security.

  • Verify the path, not only the result. In an early run, 200 exploits reported success. Twenty of them had reached root through a different 0-day than the one they were assigned. The agent had optimised for “get a root shell”, not “prove this bug”. OpenAI added an independent check that each exploit uses its assigned vulnerability.
  • Scaffolding decays. For GPT-5.5 Cyber, a library of 103 curated exploitation techniques raised the success rate from 76.2% to 88.9%. For GPT-5.6 Cyber, the lightly orchestrated setup beat the heavily scaffolded older one, and adding the library back gained only 1.5 points. OpenAI’s conclusion is to re-evaluate harnesses with every model generation, because maintenance can cost more than the gain.
  • Agents find bugs in their own sandbox. During the kernelCTF run an agent hit an unexpected crash, traced it to QEMU’s TCG emulator without access to QEMU’s source, and wrote an LPE exploit for it. The bug was already fixed upstream but not in the build OpenAI was using.

What needs care

  • “948” is a count of distinct patches, not merged fixes. When the 10-day scan and analysis ended, 61 of the LPEs had been patched upstream, 43 had staging patches and 299 were being discussed publicly. OpenAI says “hundreds” of reports and patches for critical bugs have been sent, with the rest going out gradually through its Patch the Planet partners. Its own text also says many of those early fixes came “from other contributors”, which suggests a good share of these bugs were being found in parallel by others.
  • The model is unnamed and unavailable. OpenAI calls it only “an upcoming cyber model”. Phoronix’s write-up attributes the result to GPT-5.5 Cyber, but OpenAI’s post does not say that. Nothing has been said about who will get access.
  • Cost is presented as an upper bound that better harness engineering could lower, and it excludes human review time.
  • Maintainer load is real. In May, Linus Torvalds called the private kernel security list “almost entirely unmanageable” because of duplicate AI-generated reports, and kernel policy now routes most AI-found bugs to public maintainer channels. OpenAI says it is following the kernel community’s guidance to send critical bugs first. Hundreds more patches still have to be reviewed by volunteers.

Why it matters

OpenAI’s most consequential sentence is not a number. For the near and medium term, it says, a low-privileged account on an unpatched system “should be considered functionally equivalent to root access for a well-resourced threat actor.” If that is right, a shared CI runner, a multi-tenant build box or a container on an old kernel is not an isolation boundary. The practical response is the one OpenAI itself recommends: keep kernels current, and put untrusted code behind a second layer such as gVisor or Firecracker.

The longer-term bet in the post is that within a few years frontier models will find essentially any latent bug in a codebase. If so, the advantage shifts to whoever patches fastest and to software that is secure by construction: smaller attack surfaces, memory-safe code and formal verification. The same capability that writes 948 exploits for defenders can be bought by attackers at $1,280 per bug. The open question is whether the patch pipeline, which still ends at human maintainers, can keep up.

Sources