OpenAI AI pipeline finds 948 Linux root escalation exploits

OpenAI disclosed a five-stage AI-driven pipeline that, using an upcoming cyber-focused model, validated and patched 948 local privilege escalation vulnerabilities in Linux for an API spend of about $1.213 million. The company said the run identified 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 working LPE exploits that could let an unprivileged local user obtain root access on a commonly used Linux distribution. This builds on 24 LPE exploits that OpenAI reported were found by its GPT-5.5-Cyber model earlier in 2026.

The pipeline operates through vulnerability discovery, dynamic validation, exploitability assessment, patch generation and human review. OpenAI reported that in a mid-October 2026 run, the agents reproduced 1,724 vulnerabilities within 30 hours and generated PoCs for 291 information-leak vulnerabilities and 948 LPE exploits.

The work cost $1,279 per LPE exploit, and OpenAI noted the run involved at least 10 novel Linux exploitation techniques, including two persistent elastics objects to spray kernel-cache objects, two page-grooming methods to improve reliability, five data-only techniques for privilege escalation, and one arbitrary type-confusion technique.

The UK’s National Cyber Security Centre (NCSC) and Google Threat Intelligence Group (GTIG) were cited for context on AI-enabled vulnerability discovery; NCSC warned organisations will need faster patching processes to cope with the new pace of discoveries. OpenAI argued that automated patch generation must accompany frontier-model-driven vulnerability discovery to limit exploitation windows.