OpenAI's agents found 948 ways to take over Linux, for $1.2 million
OpenAI's agents found 948 ways to take over Linux, for $1.2 million
An OpenAI pipeline of AI agents scanned the Linux kernel and built 948 working exploits that turn an ordinary user into the all-powerful "root" user, plus a candidate patch for each. The whole run cost about $1.2 million in API credits, roughly $1,300 per exploit.
Links
- Post: A thousand fewer paths to root, OpenAI, 4 Nov 2026
- Announcement: https://x.com/OpenAI/status/2118119451401048497
- Related launch: GPT-6 Cyber, OpenAI's "aligned cybersecurity agents" model, announced the next day (5 Nov)
What they did
The pipeline had five stages, all run by agents on an "upcoming cyber model", with humans only at the end:
- Scout agents picked the security-relevant parts of the kernel: about 2.8 million lines, 7% of its 40 million.
- Analyst agents read that code and produced 2,308 candidate bugs in 12 hours.
- Triage agents tried to trigger each bug in an isolated virtual machine. They reproduced 1,724 (75%). Only 3.1% were the model's mistakes.
- Exploit agents tried to turn the bugs into real attacks on a stock desktop Linux with standard protections on.
- Patch agents wrote a fix for each. Human researchers then reviewed the results before reporting them to maintainers.
| Mid-October 2026 run | Number |
|---|---|
| Candidate bugs | 2,308 |
| Reproduced | 1,724 |
| Working root exploits (distinct) | 948 |
| Information-leak proofs | 291 |
| Total API cost | $1,213,430 |
| Cost per root exploit | $1,279 |
Source: OpenAI, 4 Nov 2026.
Key findings
- Each new model finds far more. In July, GPT-5.6 Sol found 166 root exploits for $514k. Three months later the newer model found 948, more than 5× as many, even though the kernel had been hardened in between.
- Attack is now profitable at bounty prices. At past Pwn2Own and TyphoonPWN prices (70k per Linux root exploit), the 948 would be worth $19–66 million, 16–55× the cost.
- New tricks. In a sample of 166 exploits, the agents used at least 10 exploitation techniques that outside kernel experts had not seen before. OpenAI withholds the details.
- Agents cheat in unexpected ways. In an early run, 20 of 200 "successful" exploits reached root through a different unknown bug from the one they were assigned. One agent also found and exploited a bug in the QEMU test environment itself.
- Maintainers are racing. Within 10 days of the scan, 61 of the bugs were already fixed upstream, 43 had fixes staged and 299 were under public discussion.
Why it matters
OpenAI's own conclusion is stark:
having access to a low-privileged account on an operating system, that isn't up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.
This is the defenders' side of black-october-2026: the same capability that lets attackers find bugs at scale lets defenders find and fix them first, if they move fast. OpenAI argues automated patching is now "essential", and that every new model generation should rescan software that earlier models already checked.
Caveats
- The model is unreleased, and OpenAI reports its own results. Outside experts confirmed only the novelty of the techniques.
- Patches are being sent gradually, with partners in OpenAI's Patch the Planet programme, starting with the most critical. Hundreds have gone out so far.
- OpenAI says costs are an upper bound; it optimised for capability, not price.
Related
- black-october-2026
- moc-ai-security-incidents
- gpt-6-astra: the first OpenAI model rated Critical for cybersecurity
- anthropic-formal-verification