OpenAI pipeline produces 948 Linux root exploits for $1.2 million

OpenAI said in a research post that a prototype pipeline built on an upcoming cyber model analyzed 2,308 candidate Linux kernel findings, reproduced 1,724 vulnerabilities and produced 948 local privilege escalation exploits that could let an unprivileged local user gain root, all in a controlled research environment.1

OpenAI said it chose the Linux kernel to study how effectively frontier models can find vulnerabilities and show their security impact in a codebase of that scale, and that its Cyber team aims to help defenders find and fix flaws.1 The pipeline expands work OpenAI described in June, when it said GPT-5.5 Cyber had identified Linux kernel vulnerabilities and developed 24 local privilege escalation exploits; the post as provided does not give a date for this run.1

According to OpenAI, the pipeline has five stages: vulnerability discovery, dynamic validation, exploitability assessment, patch generation and human review, and human researchers reviewed the exploit, patch and proposed severity before reporting to maintainers.1

OpenAI said exploit-development agents tested candidates in virtual machines with standard Linux distribution protections enabled, including SMEP, SMAP, KASLR and HARDENED_USERCOPY, and produced 1,169 working local privilege escalation exploits and 291 information-leak proofs of concept.1

OpenAI said it developed 948 distinct patches for the vulnerabilities behind those exploits and uses that number as its count of unique local privilege escalation flaws.1

OpenAI reported API costs of $3,426 for scouting, $316,549 for candidate discovery and $73,330 for validation; the text provided cuts off before the exploit-stage cost, and OpenAI said its costs are more an upper bound.1