// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesMediumAISECCVSS not assigned

OpenAI cyber AI model generated 948 Linux root exploits

OpenAI said an upcoming cyber-focused AI model produced 948 Linux privilege-escalation exploits in a mid-October run. The Indian Express reported the disclosure on Nov 4.

· 2 min read
AI-generated image of an analyst reviewing blurred exploit research on monitors in a security operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • OpenAI said its pipeline produced 948 local privilege-escalation exploits from Linux kernel findings.
  • OpenAI said the mid-October run reproduced 1,724 vulnerabilities within 30 hours and cost $1,213,430 in API credits.

OpenAI said on Wednesday, Nov 4, that an upcoming cyber-focused AI model generated 948 local privilege-escalation exploits during a mid-October pipeline run. The exploits could allow an unprivileged local user to gain root access, according to the company.

The pipeline analyzed 2,308 candidate Linux kernel findings, reproduced 1,724 vulnerabilities and produced 948 working exploits. OpenAI said the run also generated 291 information-leak proofs of concept and used at least 10 novel Linux exploitation techniques.

Linux powers Android devices, cloud infrastructure, supercomputers and other systems used by billions of people, OpenAI said. The report did not provide a complete remediation breakdown for all 948 findings.

On this page

The pipeline turned kernel findings into working exploits

OpenAI said its agents produced 1,169 working root exploits and 291 information-leak proofs of concept. After grouping exploits that traced back to the same flaw, the company counted 948 distinct vulnerabilities.

The run cost $1,213,430 in API credits, or $1,279 for each local privilege-escalation exploit. An earlier run produced 21 privilege-escalation exploits and 25 information-leak proofs of concept over 112 hours and $32,936 in API credits.

OpenAI said an early run claimed 200 successful root exploits, but human review found that 20 had reached root through a different zero-day than the one assigned to the agent.

OpenAI said it submitted hundreds of vulnerability reports and patches to maintainers, but did not provide a complete remediation breakdown for all 948 findings. It plans to extend the research to other critical software projects through Patch the Planet.

TokenPost reported that OpenAI did not specify which kernel versions the pipeline assessed or how many generated patches Linux maintainers accepted.

What to do now

  1. Evolve internal patching and testing processes to meet the pace of accelerating vulnerability discovery.
  2. Demand reproducible exploits, accurate root-cause identification and independent validation when evaluating autonomous security tools.

FAQ

What did OpenAI’s cyber-focused AI model find?

OpenAI said the pipeline analyzed 2,308 Linux kernel findings, reproduced 1,724 vulnerabilities and produced 948 local privilege-escalation exploits.

Can the Linux exploits give a user root access?

OpenAI said the working local privilege-escalation exploits could allow an unprivileged local user to gain root access.

How much did the OpenAI pipeline cost?

OpenAI said the mid-October run cost $1,213,430 in API credits, or $1,279 per local privilege-escalation exploit.

How many of the generated patches were accepted by Linux maintainers?

TokenPost reported that OpenAI did not disclose how many generated patches Linux maintainers accepted, and the company did not provide a complete remediation breakdown for all 948 findings.

Sources

  1. Artificial intelligence and cyber intrusion, NCSCPrimary
  2. Exploring the Risks and Impacts of AI on Vulnerability Discovery and Exploitation | Blog | VulnCheck, VulnCheckPrimary
  3. OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run, The Hacker News
  4. OpenAI’s upcoming AI model built 948 working Linux root exploits in a single run, Help Net Security
  5. OpenAI Found 948 Linux Security Flaws, And Figured Out How to Exploit Them, Decrypt
  6. OpenAI Pipeline Finds 948 Linux Kernel Flaws and Generates Patches, TokenPost
  7. OpenAI built an AI pipeline to find, exploit and patch Linux flaws, CSO Online
  8. OpenAI says its AI pipeline found, patched 948 Linux security flaws in hours, The Indian Express
How we checked this story
ClaimSourceStatus
OpenAI said its pipeline analyzed 2,308 Linux kernel findings, reproduced 1,724 vulnerabilities and produced 948 local privilege-escalation exploits.OpenAI, via The Hacker NewsAttributed
OpenAI said the mid-October run reproduced 1,724 vulnerabilities within 30 hours and generated 291 information-leak proofs of concept and 948 working LPE exploits.OpenAI, via The Hacker NewsAttributed
OpenAI said the run cost $1,213,430 in API credits, or $1,279 per LPE exploit.OpenAI, via The Hacker NewsAttributed
OpenAI said the agents discovered and used at least 10 novel Linux exploitation techniques.OpenAI, via The Hacker NewsAttributed
Help Net Security reported that the pipeline wrote a patch for each underlying flaw.Help Net SecurityAttributed
OpenAI said Linux powers Android devices, cloud infrastructure, supercomputers and other systems used by billions of people.OpenAI, via Help Net SecurityAttributed
OpenAI said an early run claimed 200 successful root exploits, but human review found that 20 used a different zero-day.OpenAI, via Help Net SecurityAttributed
OpenAI said its pipeline produced 21 privilege-escalation exploits and 25 information-leak proofs of concept over 112 hours and $32,936 in API credits.OpenAI, via Help Net SecurityAttributed
Decrypt reported that the October run scanned about 2.8 million lines of kernel code, or roughly 7% of the project.DecryptAttributed
OpenAI said an earlier GPT-5.6 Sol experiment found 166 unique privilege-escalation vulnerabilities in July for $513,690.OpenAI, via DecryptAttributed
TokenPost reported that OpenAI did not specify which kernel versions the pipeline assessed or how many generated patches Linux maintainers accepted.TokenPostAttributed
TokenPost reported that the vulnerability count does not establish how many changes will reach deployed machines.TokenPostAttributed
OpenAI said initial patches sometimes introduced unnecessary code changes, performance trade-offs or failures to address related vulnerability variants.OpenAI, via CSO OnlineAttributed
OpenAI said it submitted hundreds of vulnerability reports and patches, but did not provide a complete remediation breakdown for all 948 findings.OpenAI, via CSO OnlineAttributed
IDC research director Sakshi Grover said the key risk is the time between discovery and fixes reaching production.Sakshi Grover, via CSO OnlineAttributed
OpenAI said it plans to extend the research to other critical software projects through Patch the Planet.OpenAI, via CSO OnlineAttributed
The Indian Express reported that OpenAI mentioned developing a cybersecurity pipeline on Wednesday, November 4.The Indian ExpressAttributed
NCSC said defensive AI-cyber tools have reduced the window between a vulnerability becoming zero-day and n-day.NCSCConfirmed
VulnCheck said AI-assisted vulnerability discovery has become a growing risk category requiring less skill to discover software vulnerabilities.VulnCheckConfirmed
ncsc.gov.uk published its report on Nov 3, 2026.ncsc.gov.ukConfirmed
vulncheck.com published its report on Oct 22, 2026.vulncheck.comConfirmed

Could not verify

  • Whether any of the 948 vulnerabilities were exploited in the wild is not established
  • Whether Linux maintainers accepted or deployed the generated patches is not established
  • Whether the 948 vulnerabilities received CVE identifiers is not established
  • How many deployed systems or users were affected is not established
llmopenai
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok