An unreleased OpenAI model found and exploited hundreds of Linux kernel bugs for about $1,279 each. Here's what's patched, who's exposed and what to do.
OpenAI says an unreleased cyber model, running inside an automated pipeline, built 948 working Linux root escalation exploits in one mid-October run. Each lets someone with an ordinary account on a machine take full administrator control. The run cost $1,213,430 in API credits, about $1,279 per exploit.
The Linux kernel powers Android phones, cloud servers and supercomputers, so this reaches well beyond Linux desktops. When the 10-day analysis ended, 61 bugs were fixed upstream and 43 had staging patches, with hundreds of reports sent to maintainers.
The practical step for everyone is simple: install system and phone security updates as soon as they arrive.
An unreleased OpenAI model has turned hundreds of hidden Linux bugs into working break-ins. In a single run in mid-October, OpenAI’s automated pipeline produced 948 Linux root escalation exploits, each one a way for an ordinary user account to seize full control of a machine, and the API bill came to $1,213,430.
That matters even if you have never typed a Linux command. The Linux kernel, the core of the system, sits underneath Android phones, cloud servers and supercomputers, so flaws in it reach billions of people. OpenAI says the point is to fix bugs before criminals find them. But only a slice were patched when it went public, and its own researchers now say an out-of-date system should be treated as already lost to a serious attacker.
OpenAI’s Linux root escalation exploits are working attacks for a type of bug called local privilege escalation, or LPE. In plain terms, someone who already has a normal, low-powered account on a computer uses the flaw to promote themselves to root, the all-powerful administrator account that can read every file and change anything.
That “already has an account” part is the catch. An LPE bug on its own doesn’t let a stranger in over the internet. Attackers often chain it with a separate way in, then use the kernel flaw to take over the whole machine.
OpenAI’s Cyber team ran the test against the newest Linux kernel, attacking target machines that ran an off-the-shelf desktop setup from a popular distribution with its usual protections switched on. The company hasn’t named the model it used, calling it only an upcoming cyber model, and has given no release date.
The pipeline works like a funnel with five stages, and AI agents handle almost all of it. First, scout agents picked the parts of the kernel that matter for security and that a low-privileged user can actually reach. That shrank the job to 5,034 targets, about 2.8 million lines of code, or roughly 7% of a project with more than 40 million lines.
Next, analyst agents combed those targets and needed just 12 hours to flag 2,308 possible bugs. A separate set of triage agents attempted to reproduce every lead in sealed-off virtual machines, confirming 1,724 of them within 30 hours, a hit rate of 74.7%.
Exploit-writing agents took the strongest candidates further. They built 291 proofs of concept for information leaks (bugs that expose memory or data) and 1,169 working root exploits. Because several exploits often hit the same underlying bug, OpenAI grouped them and counted 948 distinct vulnerabilities. The agents also drafted a patch for each flaw, and human security researchers checked every exploit, fix and severity rating before anything went to the kernel’s maintainers.
The agents didn’t just find bugs, they invented ways to use them. In a sample of 166 exploits, OpenAI spotted at least 10 attack techniques its researchers had never seen described, and outside kernel experts the company consulted said the methods were new to them as well. OpenAI left the technical details out of its write-up for safety reasons.
Only a small share so far. Ten days after the run, once scanning and human analysis were done, the main Linux code had fixes for 61 of these root bugs, 43 more had patches in staging, and 299 were being reported and discussed in public.
OpenAI says it has sent hundreds of reports and patches, starting with the most severe flaws because the kernel community asked for that order, and is working through the rest with partners in its Patch the Planet program. The company thanked Linux maintainers for working “urgently” on fixes.
That still leaves a long queue. Count the fixed and staged bugs together and you reach 104, set against 948 working exploits. OpenAI itself says the fast pace of disclosure and patching makes keeping software current more urgent for people and companies alike.
For most people the advice is short: install updates as soon as they arrive. OpenAI’s researchers were blunt about why. For the near and medium term, they wrote, a low-privileged account on a system missing its latest patches is “functionally equivalent to root access” for a well-funded attacker.
The test also showed why people still need to check the machines’ work. In an early run, the exploit stage claimed 200 successful root exploits, but reviewers found that 20 had gained root through a different zero-day bug than the one the agent was assigned. OpenAI tightened its rules and added an independent check that each exploit really uses the intended bug.
The price is the eye-opener. The October run averaged $1,279 per root exploit. Linux kernel privilege escalation exploits have historically earned $20,000 at the Pwn2Own contest and $70,000 at TyphoonPWN. Applied to all 948 bugs, OpenAI says those rates would put a hypothetical value of $18.9 million to $66.3 million on the haul. Nobody was actually paid that; it is an illustration.
OpenAI also tried a hardened test kernel adapted from Google’s kernelCTF program, which exposes less code to attack. Over 112 hours and $32,936 in API credits, the pipeline produced 21 privilege escalation exploits and 25 information-leak proofs. For scale, kernelCTF has accepted 26 confirmed zero-day privilege escalation exploits in all of 2026, and OpenAI estimates its 21 could have earned about $1.5 million if accepted.
The progress curve is steep. In June, OpenAI disclosed 24 LPE exploits found by its GPT-5.5-Cyber model. In July, GPT-5.6 Sol found and exploited 166 unique LPE bugs for $513,690. The new pipeline reached 948 three months later, even though the kernel had been hardened further in between.
OpenAI isn’t alone. Anthropic’s Claude Mythos has found thousands of critical flaws across many systems since its April release. Google’s threat intelligence group says monthly vulnerability disclosures more than doubled this year, from 5,045 in January to 10,740 in August, and the UK’s National Cyber Security Centre said this week that widely available AI cyber tools have almost certainly pushed zero-day discoveries sharply higher.
The worry is that attackers get the same tools. OpenAI’s own forecast is that within a few years, frontier models will likely find whatever bugs a piece of software contains, and even weaker models may manage to build exploits once flaws are public. Its answer is to pair AI bug-hunting with AI-written patches, checked by human experts.
No. OpenAI hasn’t named the model or given a release date. It describes it only as an upcoming cyber model.
No, but updates matter more than ever. These bugs need an attacker who already has a normal account on the machine, and fixes are arriving: 61 were patched upstream by the end of the 10-day analysis.
It’s OpenAI’s effort to report AI-found vulnerabilities and fixes to software maintainers with partner organizations. The Linux findings are going out through it, most severe first.
You're reading the quick version.
Read next
mSecure breach: why cloud sync matters, and what to reset first
An encrypted copy of mSecure Cloud data was taken. Here is who is exposed, what the company says to change, and why your master password now matters most.
An encrypted copy of mSecure Cloud data was taken. Here is who is exposed, what the company says to change, and why your master password now matters most.
A race condition in the WordPress update process is under attack, CISA confirms. Here is who is exposed, what the fix changes and what to check.
Freezers in stores across Europe were switched to defrost or pushed to 50C, and now UK meat suppliers say they were caught in the same wave.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
