OpenAI AI pipeline finds 1,724 Linux kernel vulnerabilities

OpenAI researchers have unveiled a five-stage automated pipeline that they say uncovered 1,724 real Linux kernel vulnerabilities and produced 948 working local root exploits during a mid-October run in 2026. The team says the investigation, powered by an upcoming OpenAI cyber model, scanned millions of lines of code in October 2026 and used the findings to write patches that closed nearly a thousand route-to-root paths.

The Linux kernel—used across billions of devices and systems—was described as having an enormous attack surface given its vast code base of more than 40 million lines of code and its reliance on system calls and drivers.

The five-stage process, as detailed in the OpenAI research briefing cited by the outlet, begins with Scout agents selecting code reachable by a local user, narrowing targets to 5,034 and 2.8 million lines of code. Analyst agents then map threat models and surface 2,308 candidate findings. Dynamic validation with Kernel Address Sanitizer in isolated VMs reproduced 1,724 vulnerabilities, confirming 74.7 percent of initial candidates; the remaining unconfirmed items were largely due to race conditions.

ExploitDev agents tested 313 info leaks and 1,238 local root candidates on protected desktops running KASLR, SMEP, SMAP and Hardened_Usercopy, yielding 291 info leaks and 1,169 working root exploits, mapped to 948 unique kernel vulnerabilities. Human reviewers later added checks to ensure exploits matched exact target bugs before patches were generated for kernel maintainers. OpenAI note that kernel maintainers moved quickly to fix issues during the scan window, with a large volume of bugs discussed publicly.