OpenAI’s autonomous pipeline produced 948 working Linux root exploits for about $1,279 each

OpenAI published results from an autonomous vulnerability discovery, exploitation and patching pipeline aimed at the Linux kernel, a roughly 40-million-line foundation for phones, clouds and supercomputers. In a mid-October 2026 run with an upcoming cyber model, it dynamically reproduced 1,724 vulnerabilities and produced 948 working local privilege escalation exploits against a stock desktop-class Linux setup, at about $1.21 million in API cost, roughly $1,279 per LPE. The related GPT-6 Cyber release cites the same 948 figure (GPT-6 Cyber). OpenAI is reporting critical issues first to the Linux community and Patch the Planet partners, bundling root-cause analysis, crashing proofs of concept, candidate patches and full exploits for human review. A parallel run against a kernelCTF-like hardened environment yielded 21 LPE exploits and 25 info-leak PoCs for about $33,000.

OpenAI’s framing deserves to be carried plainly: for the near and medium term, a low-privileged account on an out-of-date system should be treated as functionally equivalent to root for a well-resourced actor. The same economics that make the run “profitable” against historical Pwn2Own or TyphoonPWN bounties, roughly 16x to 55x on OpenAI’s hypothetical valuation, are available to anyone with comparable model access. OpenAI says agents invented on the order of ten novel exploitation techniques in a sampled set, and capability is climbing: a July GPT-5.6 Sol run found 166 unique LPEs, while the October model found 948 on later trees despite intervening hardening. Critics note simpler tools also find bugs (is that enough?).

Automated patch generation has to keep up, and sandboxes like Firecracker and gVisor are load-bearing, not optional. OpenAI admitted failure modes: ExploitDev sometimes rooted the box through a different zero-day than the assigned bug, and testing infrastructure, via a QEMU TCG issue, got compromised along the way. Autonomous cyber research without path verification and hardened infrastructure can create incidents while claiming to prevent them. If this extends to browsers, image parsers and TCP/IP stacks, as OpenAI intends, the winners will shrink attack surface and ship secure-by-default code, and maintainer capacity becomes infrastructure, a theme of OpenAI’s policy push for defenders (empowering defenders). More in our OpenAI coverage and cybersecurity coverage.