948 Linux Kernel Exploits: How GPT-6 Cyber Did It for $1.2M
OpenAI set an agent pipeline on the Linux kernel. Ten days later: 948 working root exploits and a $1.2M bill. Here is what happened.
👁 115 reads
In mid-October 2026, an engineer at OpenAI initiated an agent pipeline that began scanning the Linux kernel-the codebase running Android smartphones, public clouds, and supercomputers. Ten days later, the run concluded with 948 functional local privilege escalation exploits, each granting root access to an unprivileged user, and an API bill of $1,213,430. On November 4, OpenAI documented the findings in its report, “A thousand fewer paths to root,” revealing the following day that the underlying engine was GPT-6 Cyber. I read the report in its entirety. Here is what it shows.
Key Metrics from the Report
- 2,308 suspected bugs flagged; 1,724 reproduced inside virtual machines (74.7%).
- 1,169 functioning privilege-escalation exploits; 948 unique vulnerabilities after variant deduplication; 291 information-disclosure proofs of concept.
- API cost: $1,213,430 total, averaging $1,279 per unique exploit.
- Identical pipeline running GPT-5.6 Sol in July: 166 exploits for $513,690.
- 304 critical vulnerabilities submitted to kernel maintainers alongside proposed patches.
Why the Linux Kernel
The Linux kernel spans more than 40 million lines of code, exposing system calls, networking stacks, file systems, and hardware drivers directly to userspace. As one of the most rigorously scrutinized open-source projects, it represents an ideal benchmark: if a model uncovers novel vulnerabilities here, it can discover them in virtually any software stack. OpenAI notes that the primary bottleneck was never identifying potential bugs, but triaging thousands of candidate issues to confirm which were genuinely exploitable and required priority remediation.
The Five Pipeline Stages
The first stage deployed scout agents. These traversed directories and source files across the kernel tree to isolate 5,034 specific audit targets-areas reachable by unprivileged users with direct security implications. Together, these accounted for roughly 2.8 million lines of code, or approximately 7% of the entire kernel. This reconnaissance phase cost $3,426.
Next came the analyst agents. They inspected the code for each selected target, constructed threat models, and searched for vulnerabilities in a manner similar to the Codex Security engine. Over the course of 12 hours, they generated 2,308 unique vulnerability candidates at an API cost of $316,549.
The third phase focused on automated verification. For every candidate issue, an agent generated a standalone proof-of-concept program to trigger the flaw, executing it inside a virtual machine running a kernel built with KASAN (KernelAddressSanitizer). The agent iteratively refined the harness until the bug reproduced or its allotted attempts were exhausted. In 30 hours, it reproduced 1,724 bugs. Only 3.1% of candidate failures stemmed from flawed model analysis; the remaining unverified cases required elevated privileges or complex conditions, such as tight race windows. The verification phase cost $73,330.
The fourth stage assessed exploitability. A triage agent filtered candidates down to 313 potential information leaks and 1,238 privilege escalation targets ($44,194). Specialized exploitation agents then targeted environments configured with standard distribution mitigations: SMEP, SMAP, KASLR, and HARDENED_USERCOPY. This resulted in 291 confirmed information leaks and 1,169 working local privilege escalation exploits yielding root shells. After deduplicating variants, 948 unique vulnerabilities remained, for which 948 distinct patches were generated. This stage was the most compute-heavy, costing $775,929.
The final stage involved human validation. Security researchers reviewed the exploit chains, proposed patches, and severity ratings prior to upstream disclosure.
| Stage | Outcome | API Cost |
|---|---|---|
| Reconnaissance | 5,034 targets, 2.8M lines | $3,426 |
| Analysis (12 h) | 2,308 candidates | $316,549 |
| Verification (30 h) | 1,724 reproduced | $73,330 |
| Triage | 313 + 1,238 candidates | $44,194 |
| Exploit Generation | 291 leaks, 1,169 exploits, 948 unique | $775,929 |
| Total | $1,213,430 |
An Exploit for the Price of a Laptop
A successful root exploit cost an average of $359 in API compute. In contrast, failed attempts proved ten times as costly: 69 unsuccessful runs averaged $3,922 each, largely driven by persistent attempts to stabilize volatile race conditions. OpenAI pointed out that a basic heuristic-halting execution after an hour of stalled progress-would substantially lower expenditures, framing the $1.2M figure as an upper bound.
The report contextualizes these figures against commercial bug bounties. Pwn2Own historically paid $20,000 for a local Linux kernel privilege escalation, while TyphoonPWN reached $70,000. Applied across 948 exploits, that equates to a theoretical value of $18.9M to $66.3M-roughly 16 to 55 times the pipeline operating cost. In a secondary evaluation against a hardened kernel from Google’s kernelCTF bounty program, the pipeline ran for 112 hours and spent approximately $32,936, yielding 21 functional zero-day exploits. For context, kernelCTF accepted 26 confirmed zero-day exploits throughout all of 2026. OpenAI’s takeaway is stark: automated, large-scale vulnerability discovery is now economically viable-both for defenders and adversaries.
Better Model, Identical Pipeline, Five Times the Output
In July 2026, the identical pipeline running GPT-5.6 Sol identified and exploited 166 vulnerabilities. In October, upgraded to GPT-6 Cyber, it achieved 948. Both scans targeted the active Linux upstream master branch, separated by three months of standard community patching. The report’s primary operational takeaway: systematically rescan codebases using newer foundation models, as succeeding generations reliably resolve blind spots left by their predecessors.
Within a sample of 166 exploits, researchers documented 10 exploitation techniques that were previously unknown to both internal engineers and external kernel security specialists. Technical specifics were withheld for safety reasons.
The Agent That Exploited the Wrong Vulnerability
Among the most notable findings in the report was a significant pipeline anomaly. In an early run, the system reported 200 successful root exploits. Upon manual verification, researchers discovered that 20 of them acquired root privileges through an entirely separate, previously unknown zero-day flaw, rather than the target bug assigned to the agent. The root outcome succeeded, but via an unintended attack path. OpenAI subsequently added automated validation layers to confirm an exploit leveraged only its assigned vulnerability. This autonomous drift mirrors results seen in our analysis of the honeypot scope test.
In another instance during the kernelCTF run, an agent fuzzing system-call inputs encountered an anomalous failure, investigated it without access to hypervisor source code, and identified an unpatched vulnerability in the underlying QEMU emulator hosting the test VM. It proceeded to write a functional escape exploit. While fixed in newer upstream QEMU builds, the bug was live in the environment in use.
Upstream Response
By the time scanning and manual review finished ten days in, 61 of the discovered vulnerabilities had already been fixed in upstream master independently, 43 had patches pending on mailing lists, and 299 were under active public discussion. To prevent overwhelming kernel maintainers, OpenAI has been coordinating batch disclosures prioritized by severity, collaborating with partners from the Patch the Planet initiative.
What This Means for System Administrators
The report includes a clear operational warning: unprivileged local access on an unpatched machine must now be treated as functionally equivalent to root access when facing a capable adversary. Key architectural takeaways:
- Patch kernels immediately rather than on quarterly schedules-over 100 vulnerabilities advanced toward fixes during OpenAI’s ten-day run alone;
- Never assume unprivileged user accounts provide an effective security boundary if untrusted third parties can execute arbitrary binaries;
- Implement strict service isolation-OpenAI highlights lightweight hypervisors such as Firecracker and sandboxing runtimes like gVisor to mitigate breach impact;
- When employing autonomous agents for vulnerability research, verify the exact execution trace and mechanism, not merely whether root access was achieved.
For more analysis on this model, visit our GPT-6 Cyber overview, or read our breakdown of GPT-6 Cyber API pricing.
Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →Sources
- OpenAI, A thousand fewer paths to root, Nov 4, 2026
- OpenAI, GPT-6 Cyber, Nov 5, 2026
