Research investigation R1105 / claim audit
OpenAI’s roughly 45× Linux bounty scenario uses a modified kernelCTF target
The supplied evidence reproduces OpenAI’s hypothetical reward arithmetic, but does not establish rule-matched bounty revenue or fully loaded financial returns. The desktop and adapted-kernelCTF campaigns require separate accounting.
Early sample. Read individual values rather than treating the pattern as a market trend.
Version ledger
Frozen public editions
Each edition preserves the records, method, sources, and downloads available at publication time.
The sample covers two reported campaigns and three cited reward programs, not exploit economics generally. Preserve the editorial cutoff of November 5, 2026, 03:31:42.046 UTC. Supplied page snapshots were retrieved at 03:32:44.176 UTC; they are checked versions, not independently archived versions at the exact cutoff. Recovering this saved evidence is not a new collection or experiment.
- Dataset ID
- spd:openai-s-linux-exploit-economics-what-do-the-bounty-comparisons-actually-measure-f5e91807
- Stable URL
- /research/openai-s-linux-exploit-economics-what-do-the-bounty-comparisons-actually-measure-f5e91807
- Version
- v1
- Coverage
- Live collection
- Records
- 6
- Fields
- 7
- Updated
Measurement technique
How to read this report
- 01Use the five supplied primary documents: OpenAI’s disclosure, Google’s kernelCTF rules, Pwn2Own Berlin 2026 rules, and TyphoonPWN’s reward schedule and FAQ. Treat secondary coverage and social posts as attention signals, not independent validation.
- 02Keep the desktop campaign and adapted-kernelCTF campaign separate. Distinguish total campaign API credits, reproduced vulnerabilities, exploit outputs, patch-deduplicated LPEs, hypothetical rewards and accepted payments.
- 03Plan an evidence_matrix with columns for campaign, cost denominator, hypothetical reward calculation, required target, eligibility and timing restrictions, comparison status, and supporting source. Distinguish reproducible arithmetic from conditional rewards and publicly indeterminate payouts.
- 04Desktop cost row: OpenAI reports $1,213,430 in campaign API credits, 1,724 reproduced vulnerabilities and 948 unique LPEs. Total credits divided by unique LPEs gives $1,279.99, rather than the reported $1,279. The approximately $359 successful-exploit development average uses a different denominator and cost scope; 1,169 exploit outputs became 948 patch-deduplicated LPEs, and unsuccessful attempts also consumed credits.
- 05Desktop/Pwn2Own row: 948 × $20,000 divided by $1,213,430 reproduces the approximately 16× scenario. The reward concerns fully patched RHEL Workstations 10.1, with one registration per target and first-winner closure under standard rules. The May 14–16 competition preceded the campaign. Status: historical-price arithmetic, not established eligibility or revenue.
- 06Desktop/TyphoonPWN row: 948 × $70,000 divided by $1,213,430 reproduces the approximately 55× scenario. The advertised amount is a ceiling; specified fully patched distributions and novelty conditions apply. Successive awards receive 100%, 50% and 25%, after which the category closes unless extended. The May 28 competition preceded the campaign. Status: ceiling-price arithmetic, not rule-matched revenue.
- 07Adapted-kernelCTF row: $1,498,077 divided by approximately $32,936 reproduces 45.48×. OpenAI used latest Linux without SLAB_VIRTUAL; official rules require SLAB_VIRTUAL on Linux 7.2-rc5. Additional conditions include an LTS 6.12 trigger, reliability testing, novelty, competitive slots and publication. Status: arithmetic reproduced; target equivalence fails and finding-level payment eligibility remains indeterminate.
- 08Do not add reward scenarios together automatically: novelty and prior-disclosure restrictions can make them alternative routes rather than additive proceeds. No exploits were executed or independently validated.
Sources
Evidence
4 publishers supporting 6 records. Expand a publisher to inspect its cited pages.