A thousand fewer paths to root
OpenAI’s cyber research team built an automated pipeline that identified and patched 948 Linux kernel vulnerabilities, demonstrating how frontier models can scale vulnerability discovery and remediation.
OpenAI’s Cyber team developed an autonomous pipeline that uses an upcoming cyber model to scan the Linux kernel for security flaws. Over a mid-October 2026 run, the system dynamically reproduced 1,724 vulnerabilities and generated 948 working local privilege escalation exploits, alongside 291 information leak proofs of concept. The campaign cost $1,213,430 in API credits, averaging $1,279 per exploit generated.
The pipeline operates in five stages: vulnerability discovery, dynamic validation, exploitability assessment, patch generation, and human review. It first identifies security-relevant code sections, statically scans for candidate flaws, and then dynamically reproduces findings in an isolated environment to confirm exploitability before generating patches.
In a controlled kernelCTF environment, the pipeline produced 21 local privilege escalation exploits and 25 information leak proofs of concept, costing $32,936 in API credits. If accepted, these 21 vulnerabilities could yield approximately $1.5 million in bounty awards, roughly 45 times the scanning cost.
The research highlights the rapid pace at which frontier models can uncover vulnerabilities, with over 100 Linux kernel local privilege escalation flaws patched or discussed within 10 days of the scan. OpenAI emphasizes the need for automated patch generation to keep pace with discovery rates and reduce exploitation windows in large, complex software systems.