OpenAI says AI agents exploited 948 Linux kernel flaws in one run

OpenAI says an automated research pipeline built on an unreleased cyber model produced working exploits for 948 distinct Linux kernel flaws that let an ordinary local user become root. The company published the research and announced it on X at 23:13 UTC on Wednesday, putting the cost of the whole run at $1,213,430 in API credits, about $1,279 per flaw. It calls its cost figures an upper bound, since the work focused on method rather than cost.

Most of the flaws were not fixed when OpenAI finished its analysis. The scan ran against the latest kernel in mid-October, and when the scan and manual review ended 10 days later, 61 had been patched upstream, 43 had patches in staging and 299 were being reported and discussed publicly. Following advice from the kernel community, OpenAI says it has sent hundreds of reports and patches for the critical flaws and is sending the rest gradually with partners in its Patch the Planet programme.

Linus Torvalds's tree has close to 20 commits dated since October 14 with an openai.com sign-off or report credit, though none says whether it came from this run. An earlier one, a netlink fix merged on October 13, shows the form they take: signed by an OpenAI researcher, marked "Assisted-by: LLM" and accepted by networking maintainer Paolo Abeni. It fixes an information leak that let an unprivileged user read kernel memory left in a packet's reserved headroom through a socket filter.

What the pipeline did

OpenAI describes five stages. Scout agents picked 5,034 audit targets reachable by low-privileged users, about 2.8 million lines or 7% of the kernel. Analyst agents turned those into 2,308 candidate findings in 12 hours. Triage agents reproduced 1,724 of them within 30 hours in virtual machines running KASAN, the kernel's memory error detector. OpenAI says 3.1% of the findings were analysis errors by the model.

Exploit agents then attacked the candidates on virtual machines with the protections of a standard distribution switched on, including SMEP, SMAP and KASLR. They produced 1,169 working root exploits and 291 information leak proofs of concept. Variant analysis reduced the 1,169 exploits to 948 separate patches, which is how OpenAI counts 948 distinct flaws. Human researchers review each exploit, patch and severity rating before anything is reported.

On Google's kernelCTF configuration, a hardened kernel with less exposed code, a separate 112-hour run produced 21 root exploits for about $32,936, OpenAI reports. It compares that with the 26 confirmed zero-day root exploits kernelCTF has accepted in 2026. One mitigation, SLAB_VIRTUAL, was left out of that test because it does not work with the latest kernel.

What OpenAI found about the agents

In a sample of 166 exploits, OpenAI says the agents used 10 exploitation techniques that, to the best of its knowledge, are new, and that outside kernel exploitation experts had not seen either. It describes them only by type (new heap spray objects, page grooming, data-only and type confusion techniques) and is withholding the full details for safety reasons. In an early run, 20 of 200 reported successes had reached root through a different, unknown flaw than the one the agent was assigned, so the company added an independent check that each exploit uses its own bug.

A July scan with GPT-5.6 Sol found 166 Linux kernel root flaws for $513,690, and OpenAI advises rescanning audited code as models improve, since a stronger model may find what an earlier one missed. Applying the $20,000 and $70,000 that Pwn2Own and TyphoonPWN have historically offered for a Linux kernel root exploit, OpenAI puts a hypothetical value of $18.9 million to $66.3 million on the 948, which it says is 16 to 55 times the cost of the run.

What has not been published

Each flaw lets an unprivileged local user gain root, so a threat actor first needs a foothold as an ordinary user on the machine. OpenAI has not published a list of the flaws, CVE numbers, the kernel versions that carry fixes, or a date for when all 948 reports will have been sent.