OpenAI says its AI pipeline built 948 exploits that give Linux users root access

An ordinary local user could gain root access—the highest level of control—through 948 working Linux exploits generated by OpenAI’s prototype security pipeline, the company says. Published November 4, its research describes a mid-October 2026 run that paired attack demonstrations with candidate fixes, using an unnamed upcoming cyber model and human review before reporting vulnerabilities.

OpenAI says its target virtual machines ran a stock desktop operating system, rather than one weakened for testing. The exploits demonstrated local privilege escalation: turning an existing low-privilege foothold into root access, not breaking into a machine remotely.

From a suspicious file to a working attack

Scout agents selected security-relevant code reachable by low-privilege users, narrowing the audit to about 2.8 million lines, roughly 7% of the kernel. Analyst agents then produced 2,308 candidate findings after duplicates were removed, within 12 hours.

Validation agents wrote small programs to trigger potential bugs, ran them in isolated virtual machines and refined their attempts using the results. OpenAI focused on flaws reachable without special privileges that showed measurable memory corruption. Within 30 hours, the system reproduced 1,724 vulnerabilities, about three-quarters of the candidates.

Proving severity has a price

Reproducing a bug establishes that something is wrong, but not how much damage it permits. The next stage assessed whether confirmed flaws could disclose information or elevate privileges. Alongside the root-access exploits, the pipeline generated demonstrations for 291 information leaks.

The company’s cost analysis puts the full run at $1,213,430 in API credits—not an all-in research expense figure. OpenAI says the work emphasized methodology and capability rather than cost optimization, and expects better workflow engineering could reduce spending.

$1,279Per local privilege-escalation exploit

OpenAI’s average spreads the full pipeline’s API cost across its working privilege-escalation exploits.

Candidate patches still need maintainers

Each completed package included a root-cause analysis, a minimal program that triggered a crash, a candidate patch and a full exploit. Following Linux community guidance, OpenAI began reporting critical vulnerabilities and says it is working with Patch the Planet partners on further reports and patches.

OpenAI says the newer pipeline found more than five times as many novel privilege-escalation vulnerabilities as a July run using GPT-5.6 Sol, despite three intervening months of hardening. It argues that large software projects need repeated scans with successive model generations.