OpenAI pipeline produced 948 Linux kernel root exploits for $1.2 million, report says

The first evaluation ran in mid-October 2026 against the Linux kernel master branch, CryptoBriefing reported. The system flagged 2,308 candidate vulnerabilities in a single run and reproduced 1,724 in isolated test environments. It generated proofs of concept for 291 information leaks. The headline result was 948 functioning local privilege escalation exploits, or LPEs, for distinct vulnerabilities. The total API bill came to $1,213,430, or $1,279 per exploit.

The run

Blockchain.news reported that OpenAI described the system as able to identify, validate and generate patches for local privilege escalation vulnerabilities. CryptoBriefing reported that the run examined approximately 2.8 million lines of security-relevant code, about 7% of the kernel, and that the exploits worked on standard desktop Linux setups running typical security mitigations, citing research findings.

An LPE lets someone who already has ordinary access to a machine promote themselves to root, the account that controls everything. CryptoBriefing noted that local privilege escalation bugs require an attacker to already have some foothold, though attackers often chain an LPE with a separate entry point to take full control. Kernel-level root exploits have historically required skilled specialists and significant time to develop. For defenders, the most important figure may be the $1,279 average per exploit.

The patching gap

The report said 61 vulnerabilities had been fixed upstream and 43 were moving through a staged patch process as of the announcement. That is 104 fixed or in progress against 948 working exploits, leaving a large backlog for human review.

From 24 to 948

In June 2026, OpenAI published Patch the Planet disclosures covering 24 LPE exploits found by an earlier model, GPT-5.5 Cyber. The new count is nearly 40 times that figure, but CryptoBriefing cautioned that the comparison is not apples to apples: the new figure comes from a dedicated autonomous pipeline, while the earlier count came from a model, and the scope of each effort may differ.

What comes next

OpenAI has not disclosed which kernel versions the pipeline was tested against, the computational methods it used, or what share of its generated patches Linux maintainers accepted, Blockchain.news reported. The report said practical impact depends on reproducibility of the findings, exploitability of the identified vulnerabilities, and integration of generated patches into widely deployed Linux distributions.

CryptoBriefing noted that the run covered only a slice of the kernel, so future runs could widen the net. The next step is human review of the remaining reports before patches reach Linux distributions.