On November 4, OpenAI published a Linux kernel security research report. A pipeline driven by an unreleased cybersecurity model ran once in mid-October and produced 948 distinct local privilege escalation (LPE) exploits, each paired with a candidate patch. The API bill for the run was $1,213,430. OpenAI works that out to roughly $1,279 per escalation, and says the cost figures are upper-bound estimates.
The report is titled "A thousand fewer paths to root." It is easy to read 948 as 948 vulnerabilities already fixed, and several outlets have cautioned against that: the number refers to validated exploits and pipeline-generated candidate patches. Fixes actually merged into the kernel are a separate count.
A funnel that narrows at every stage
The pipeline is a relay of several kinds of agents. Scouting agents pick code based on reachability and security relevance, analysis agents scan the targets, and triage agents generate and refine proofs of concept inside virtual machines running the Kernel Address Sanitizer, keeping the runtime evidence as they go.
| Stage | Output |
|---|---|
| Audit targets | 5,034, about 2.8 million lines, roughly 7% of the kernel |
| Candidate findings after deduplication | 2,308 |
| Dynamically reproduced | 1,724 |
| Information-leak proofs of concept | 291 |
| Working privilege-escalation exploits | 1,169 |
| Privilege escalations after deduplication by independent patch | 948 |
The drop from 1,169 to 948 comes from variant analysis, which merged exploits that point to the same root cause; OpenAI uses the number of independent patches as its counting basis for escalations. According to reports, most candidates that never reached reproduction either required higher privileges or could not be reproduced within the time budget.
Testing took place in isolated virtual machines. Reports say the targets were desktop configurations of common distributions with SMEP, SMAP, KASLR and HARDENED_USERCOPY all enabled, and that protections were not deliberately weakened for the experiment.
Three milestones in four months
Putting together the project's earlier public figures gives this picture:
- June: the Patch the Planet project launched; its kernel scans at the time yielded 24 privilege escalations and 8 pointer-leak proofs of concept.
- July: GPT-5.6 Sol produced 166 independent privilege escalations at a cost of $513,690.
- October: the unreleased cybersecurity model produced 948 at a cost of $1,213,430.
A rough calculation puts the cost per escalation down from about $3,095 in July to $1,279, a drop of around 60%. The two rounds may not share the same scan scope or process details, so the comparison should be treated as a reference point only.
Another set of numbers comes from Google's kernelCTF, a considerably more hardened target. The same pipeline produced 21 privilege escalations there at a cost of about $32,936. A third-party tally says kernelCTF has confirmed 26 zero-day privilege escalations in total so far this year. How many of those 21 will be accepted has not yet been determined.
OpenAI also says the agents used at least 10 previously unknown Linux exploitation techniques, a judgment that comes from the company itself and the experts it consulted. For safety reasons the technical details have not been released, so outsiders cannot check the claim for now.
Flaws the report admits to
In early runs, 20 of 200 exploits reported as successful got root through a different zero-day rather than the vulnerability the task specified. OpenAI tightened the task constraints in response and added an independent check on the exploit path.
Nor are all 948 escalations new discoveries. According to reports, 61 had already been fixed upstream by others, 43 had pre-release patches, and 299 were being publicly reported or discussed. The reports do not make clear whether these three groups overlap; if they do not overlap at all, together they would account for about 40%.
On follow-up, OpenAI says it has sent maintainers reports and patches for several hundred serious vulnerabilities, with the rest going out in batches through Patch the Planet partners. Startup Fortune mentions that submissions first have to get past engineers at Trail of Bits.
Still undisclosed are the model's official name, how much human review went into the work, and how many patches maintainers ultimately accepted. All the numbers come from a single OpenAI experiment and have not been independently verified.
Limited human bandwidth is already an old problem for open-source maintainers; Postgres 19 was delayed because bugs reported by LLMs could not be fixed fast enough. With 948 candidate patches heading to kernel maintainers in batches, how many can actually be reviewed will show up in the commit logs of the next several kernel releases.
Sources: OpenAI security research report, Startup Fortune, CocoLoop, Unite.AI, FourWeekMBA. Counts and costs for each stage follow OpenAI's report; the number of kernelCTF confirmations comes from a third-party tally.