OpenAI pipeline finds 948 Linux kernel privilege escalation flaws – Unite.AI

OpenAI reported on November 4, 2026, that a prototype pipeline using an upcoming computing model found and exploited 948 unique local privilege escalation vulnerabilities in Linux during a mid-October 2026 research run, also generating patch candidates for maintainer review.

The flaws could give a local, non-privileged user root access. The tests took place on isolated virtual machines running a standard desktop operating system with SMEP, SMAP, KASLR, and HARDENED_USERCOPY enabled, rather than on a deliberately weakened target. OpenAI chose Linux because the kernel contains more than 40 million lines of code and powers Android devices, cloud infrastructure, and supercomputers, providing an automated search test against a code base of this scale and importance.

From candidate results to work exploits

The pipeline connects vulnerability discovery, dynamic validation, exploitability assessment, patch generation, and human review. Scout agents select code based on its reachability by low-privilege users and security relevance, after which analyst agents scan the targets. Triage agents generate and refine proofs of concept within virtual machines running kernels with Kernel Address Sanitizer, preserving runtime proofs rather than relying solely on static analysis. Each completed research package contains a root cause analysis, a minimal crash proof of concept, a patch candidate, and a complete exploit.

OpenAI said the scouts selected 5,034 audit targets covering about 2.8 million lines, about 7% of the kernel. Analysts produced 2,308 deduplicated candidate results within 12 hours, and dynamic validation reproduced 1,724 vulnerabilities within 30 hours. Most of the remaining results required elevated privileges or could not be reproduced within the time budget; only 3.1% reflected incorrect model analysis.

According to OpenAI, the exploit phase produced 291 proof-of-concept information leaks and 1,169 working local privilege escalation exploits. The variant analysis then produced 948 distinct patches, and OpenAI uses that figure as the number of unique LPEs, explaining why the total vulnerabilities differ from the raw exploit count. The generated fixes remain candidates for review by the maintainer; the figure of 948 does not include the count of merged patches.

Human review and patch status

OpenAI has submitted hundreds of reports and patches for critical vulnerabilities and plans to gradually roll out the rest with Patch the Planet partners. OpenAI introduced the Daybreak initiative with Trail of Bits on June 22, 2026, pairing AI-assisted research with expert review while maintainers maintain control over patch distribution and dissemination. The previous announcement reported 24 LPE exploits and eight kernel pointer leak proofs of concept from its GPT-5.5 Cyber ​​Linux work.

After finding 61 LPEs already patched upstream, 43 with staging patches, and 299 reported or publicly discussed at the end of the ten-day scan and manual analysis, OpenAI recommended revalidating the results against the current code, including subsequent merges, to avoid duplicate or outdated reporting. The goal is to focus maintainers on unresolved vulnerabilities without adding unnecessary review burden.

The review also found an error that the root shell alone would have hidden. In an initial analysis, OpenAI said that 20 of the 200 successfully reported exploits gained root through a different day 0 than the assigned vulnerability, after which it tightened task constraints and added independent checking of each exploit’s path. The first directly requested patches may be functionally correct while containing unnecessary code, potential performance compromises, deviations from coding conventions, or incomplete variant coverage. Further instructions and iterations have improved the quality of the patches, as human researchers continue to review the exploit, patch, and proposed severity before reporting them to maintainers.

Model comparison and test costs

OpenAI’s comparison places the mid-October run at $1,213 million in API credits, or $1,279 per unique LPE, versus 166 unique LPEs and $513,690 for a late July 2026 GPT-5.6 Sol run. Both scanned the latest Linux kernel master branch available at the time. The reported more than fivefold increase in new LPEs occurred despite three months of strengthening between scans. Costs are presented as upper bounds because the research has focused on methodology and capability measurement rather than cost optimization.

OpenAI said a sample of 166 exploits contained ten techniques that both its team and third-party kernel exploitation experts deemed novel, which included persistent elastic objects, page cleanup, data-only privilege escalation, and arbitrary type confusion. Full technical details have been withheld for security reasons.

An adapted run of kernelCTF produced 25 information leak proofs of concept and 21 LPE exploits in 112 hours for approximately $32,936 in API credits, OpenAI reported. The tested kernel was incompatible with the SLAB_VIRTUAL mitigation, so OpenAI removed it from the configuration. The figure of around $1.5 million is contingent on all 21 vulnerabilities being accepted, rather than an announced reward. Google’s kernelCTF rules provide a reward of $71,337 for each eligible exploit, require at least 70% stability over 20 executions, and limit rewards to eligible submissions that are 0 days old.

The results shift the bottleneck from lead generation to demonstrating exploit paths, keeping results fresh and producing acceptable solutions. This makes independent verification and review by maintainers critical to determining whether automated search at this scale becomes usable defensive work rather than an additional reporting burden.