948 flaws in a single run at a cost of about $1.2 million
OpenAI on Nov. 4 (Nov. 5 Japan time) published results from a system that uses AI to find vulnerabilities (exploitable flaws) in the core of Linux (the kernel), check whether attacks work and even produce proposed fixes. It said a single run using an unreleased upcoming cyber model validated, and produced proposed fixes for, 948 "local privilege escalation" flaws that let ordinary users seize administrator (root) privileges. The total API cost was $1,213,430, or about $1,279 per flaw. All of these are the company's own statements; as of Nov. 5, no third-party verification had been found, and the figures are unconfirmed.
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline. In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
The run took place in mid-October and targeted the latest kernel under development. From about 40 million lines of code, it selected about 2.8 million lines, or about 7% of the total, focusing on areas reachable by low-privilege users. AI agents (systems in which AI carries out work on its own) identified 2,308 candidates and reproduced 1,724 in an isolated environment. They also produced 291 proof-of-concept exploits for information leaks. The exploit code worked on a standard desktop configuration with standard protections enabled, the company said. Human researchers check the results before they are reported.
The 948 differs from the number of working exploits itself. According to Unite.AI and CellCog, 1,169 exploits were produced, which came to 948 distinct flaws when counted by proposed fix. A poster identifying themselves as the pipeline's author explained on the developer forum Hacker News that these were distinct vulnerabilities counted by patch.
Count more than five times July's run, with lower cost per flaw
According to OpenAI, a run of the same system using "GPT-5.6 Sol" in late July found 166 distinct privilege escalation flaws at a cost of $513,690. That works out to about $3,100 per flaw (ORIENS' calculation), above the roughly $1,279 this time. The company said it found more than five times as many new flaws even in a kernel that had undergone three months of fixes in the interim. The result for "GPT-5.5 Cyber," published in June, was 24 exploits.
Most of the cost went to exploit development; amount is an upper bound
Most of the cost went to developing exploits. The breakdown reported by CellCog was about $776,000 for development, about $317,000 for the analysis that identified candidates and about $73,000 for checking reproduction. OpenAI said the amount is an upper bound without any cost-cutting measures and does not represent the total cost of research and fixes.
As a point of comparison on scale, the company cited Google's "kernelCTF," a bounty program in the style of an attack competition. In a run tailored to that program's hardened targets, it produced 21 privilege escalation exploits in 112 hours for about $33,000. The program has so far accepted 26 privilege escalations using unknown flaws in 2026, it said. However, the 21 were not accepted by the program, and some protections were removed from the configuration.
In monetary terms, it estimated that applying prize money from past hacking competitions ($20,000 to $70,000 per flaw) to the 948 flaws would come to $18.9 million to $66.3 million. That is 16 to 55 times the cost of the run. OpenAI calls this a hypothetical value, and AlphaSignal noted that it is likely to be inflated given the scope of bounty programs and duplicates.
At least 10 new techniques, details not disclosed
OpenAI also said the agents found and used at least 10 new types of attack techniques. They are new to the best of the company's knowledge and of all the experts it consulted, it said. It argues that this shows frontier AI can discover new techniques, not just apply known ones.
According to Unite.AI, the techniques were confirmed among 166 sampled exploits. As far as could be confirmed, it is not clear which run the sampled exploits came from. The names of the experts consulted could not be confirmed, and technical details have not been released for safety reasons. As a result, there is currently limited material for outside researchers to confirm the novelty.
Fixes still in progress; 948 is not the number applied
The 948 proposed fixes are candidates awaiting review by Linux developers (maintainers) and differ from the number of fixes merged into the kernel. OpenAI said it has sent several hundred reports and proposed fixes, starting with the most serious, and will handle the rest with partners in "Patch the Planet," an initiative supporting open-source fixes. It has not disclosed the number of fixes accepted.
At the end of the 10-day investigation, 61 of the flaws found had already been fixed upstream, 43 were in preparation for fixes and 299 were being discussed publicly. CellCog reported the 61 as fixes by others.
The company also listed limitations of the system. In early runs, 20 of 200 cases deemed successful had seized privileges using unknown flaws other than the ones assigned. Early proposed fixes also contained unnecessary code, performance degradation and code that departed from development conventions, which were improved with additional instructions and iteration, it said.
The attacks require first having a low-privilege account on the target machine. On the other hand, attackers may combine them with other intrusion methods to take over an entire machine. The scope examined was about 7% of the kernel, and the remaining parts and non-standard configurations were out of scope.
No third-party assessment has come out yet. ORIENS checked major security outlets and discussion on Hacker News but found no independent reproduction or verification by kernel developers. The model used has not been released, so it cannot be tested from outside under the same conditions. On Hacker News, posts also questioned the large number and criticized the work as closer to promotion than research.
Burden on developers and the cost of defense in focus
Reports of flaws found by AI have become a burden for Linux developers. Creator Linus Torvalds said in May that duplicate AI-generated reports had made the security mailing list "almost unmanageable." In July, 442 vulnerabilities were disclosed over three days, which Risky Bulletin considered likely to have been found with AI. On Nov. 1, Torvalds described the flow in which AI-prompted fixes enter the window for accepting new features as a much healthier model.
OpenAI argues that defenders should examine software preemptively and make attacks too costly to be worthwhile. On the other hand, RuntimeWire noted that if the same capability reaches attackers, the time from a code change to working exploit code will shrink. The poster identifying themselves as the pipeline's author wrote that they plan to re-examine Linux each time a new generation of cyber models is released.
Model name not disclosed; competitors also expand AI flaw hunting
OpenAI referred to the model used only as an "upcoming cyber model" and has not disclosed its name or release timing. The Information reported on Nov. 4 that OpenAI's new cyber model could be released as early as Nov. 6. In October, the name of an unreleased "astra-cyber-preview" was found in the latest version of Cognition's "Devin." It is not known whether the model used this time is the same as these.
The company offers models with strong cyber capabilities only to approved defenders, and it launched Patch the Planet with Trail of Bits in June. According to Safeguard, the overall initiative, "Daybreak," has committed $1 billion worth of subsidized usage credits, which differ from cash grants. Addressing "PHP2Shell," a serious flaw in PHP, a language widely used on websites, was also part of Patch the Planet.
Among competitors, Anthropic in October launched "OSS Scanner," which examines important open-source software for free with its top model. The company said it also found a flaw in the kernel's TCP handling (CVE-2026-98432, rated 9.8 out of 10 for severity) and built exploit code that seizes administrator privileges remotely without authentication. That flaw can be attacked remotely, so its attack preconditions differ from the 948 flaws here. Google first offered its top "Gemini 4 Carbon" to cyber defenders, and Microsoft also released the cyber model "MAI-Cyber-1.1-Flash."
