OpenAI's AI agents built 948 working Linux root exploits in one run, for $1.2M in API credits

What happened? OpenAI says an autonomous vulnerability pipeline, powered by an upcoming cyber model, scanned the Linux kernel in mid-October 2026 and in a single run reproduced 1,724 real vulnerabilities and produced 948 distinct working local privilege escalation exploits, each of which lets an ordinary user take root on a stock desktop Linux distribution with standard protections switched on. The whole run cost $1,213,430 in API credits, about $1,279 per root exploit. The pipeline also wrote a candidate patch for every one, and human researchers reviewed the results before reporting them to kernel maintainers.

Why it matters Finding a kernel root exploit used to be weeks of specialist work, with bug bounty programmes paying $20,000 to $70,000 for one. OpenAI puts the hypothetical bounty value of this batch at $18.9M to $66.3M, 16 to 55 times what the run cost, and says its agents discovered at least 10 new Linux exploitation techniques. Security research is turning into a compute budget, for defenders and attackers alike. The open question is whether patching can keep up: when the run finished, 61 of the flaws had been fixed upstream and 43 more had patches in staging. It follows Anthropic's report that Claude wrote a remote root exploit for a critical Linux kernel bug.

Source OpenAI: A thousand fewer paths to root (4 November 2026)