OpenAI has built an autonomous pipeline that found, exploited, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel — in a single 30-hour run. The total API cost was $1,213,430, or roughly $1,279 per working exploit. If those exploits were submitted to traditional bug bounty programmes like Pwn2Own and TyphoonPWN, they'd be worth between $18.9 million and $66.3 million — a 16x to 55x return on the pipeline's cost.
This isn't a theoretical exercise or a benchmarking stunt. OpenAI has already submitted hundreds of vulnerability reports and patches to Linux kernel maintainers. Combined with Anthropic's recent disclosure that an unreleased Claude model chained vulnerabilities across Chrome, Safari, Android, Windows and Linux into working exploits, and Google Project Zero's Big Sleep agent finding 45 V8 bugs in six months, the picture is clear: AI has made vulnerability discovery cheap. What remains expensive — and increasingly urgent — is fixing what gets found.
How the pipeline works
The system operates in five stages, powered by an upcoming and as-yet-unnamed OpenAI cyber model. Scout agents first identify security-relevant sections of the kernel's codebase — roughly 7% of the 40-million-line project. Analyst agents then scan those targets and flagged 2,308 candidate vulnerabilities. Triage agents dynamically reproduced 1,724 of them in isolated virtual machines running an unmodified desktop Linux distribution with standard protections (KASLR, SMEP, SMAP) enabled.
From those validated findings, the pipeline produced 1,169 working local privilege-escalation exploits and 291 information-leak proofs of concept. After variant analysis to consolidate duplicates, 948 distinct vulnerabilities remained — each with a root cause analysis, a minimal crashing proof of concept, a candidate patch, and a full working exploit. Human security researchers at OpenAI then reviewed the outputs before submitting reports to maintainers.
The exploit stage alone consumed $775,929 of the $1.2 million total — the most expensive part of the pipeline. But the cost is falling fast. An earlier run in late July, powered by GPT-5.6 Sol, produced 166 unique LPE exploits at a cost of $513,690. The newer cyber model found more than five times as many novel exploits despite three months of kernel hardening between scans.
The economics just flipped
Perhaps the most consequential detail: the pipeline discovered at least 10 novel Linux exploitation techniques that kernel exploitation experts outside OpenAI weren't familiar with. These include two new persistent elastic objects for kernel cache spraying, two page-grooming techniques, five data-only privilege-escalation methods, and one arbitrary type confusion approach. OpenAI is withholding full technical details for safety reasons.
This represents a qualitative shift, not just a quantitative one. The pipeline isn't merely finding bugs faster — it's inventing new ways to exploit them.
The numbers align with a broader pattern across the industry. DARPA's AI Cyber Challenge (AIxCC) finalists found and patched synthetic vulnerabilities at roughly $152 per task, far below traditional bounty values. Google Project Zero's comparison of its Big Sleep AI agent against the Fuzzilli fuzzer found only 25% overlap in discovered bugs, meaning AI and traditional tools are complementary rather than redundant.
As an arXiv analysis of AI-driven "bugonomics" put it: AI systems don't invent defensive security economics — they change the scale and distribution. Activities previously concentrated in well-funded vendors and elite research teams can now be automated and repeated across large codebases.
The new bottleneck: who reviews 948 patches?
The uncomfortable truth buried in these numbers is that vulnerability discovery has outpaced the capacity to act on what's found. During the 10 days while OpenAI's scan was running, over 100 of the vulnerabilities it discovered were independently patched upstream, with another 300 being publicly discussed. The Linux kernel community is working flat out.
But it's not enough. Linux networking maintainer Jakub Kicinski estimated that between one-third and one-half of the 648 net-next patches in a recent kernel cycle were low-priority fixes, cleanups, or clarifications driven by AI. "We are completely overwhelmed," Kicinski wrote. Linux stable maintainer Greg Kroah-Hartman has documented CVE counts jumping above 1,000 with Linux 7.0 and exceeding 1,500 with Linux 7.2. If the trajectory holds, Linux 7.3 could push beyond 2,000 CVEs per release.
OpenSSF chief security architect Christopher Robinson told The Register that roughly 30% of reported Linux security bugs were duplicates — "That's going to be another problem in this AI age, where everybody's a researcher with a $20 cloud code account."
Trail of Bits is attacking the backlog from the other side. Using OpenAI's Codex, its engineers have delivered fixes for 149 distinct CVEs into stable Linux kernel releases, reducing backport preparation from days to 30 minutes of human attention per straightforward fix. As Trail of Bits researcher Dan Guido put it: "A swarm of cyber-capable AI agents can cut through a network of stable, known-vulnerable software like a hot knife through butter."
This is the new reality: OpenAI's own earlier experiments found that 20 of 200 purportedly successful exploits had obtained root by exploiting a different vulnerability than the one assigned — a reminder that AI-generated security work still requires expert validation. Discovery is automatable. Trust is not.
What this means if you run a business
If your business runs on Linux — and if you use cloud computing, it almost certainly does — the practical implications are stark. OpenAI's own assessment is blunt: "For the near and medium term, having access to a low-privileged account on an operating system that isn't up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor."
That's not marketing language. It's an architectural recommendation backed by 948 working exploits.
AWS has already adapted its approach. Its EC2 kernel team uses AI agents to triage incoming CVEs in roughly 3.4 seconds each, versus minutes for a human — but two engineers still review every classification. AWS also found that older LTS kernel branches carry dramatically more unfixed CVEs: 1,709 known unfixed CVEs on Linux 5.10 versus 229 on Linux 6.18.
For smaller businesses, the calculus is simpler but no less urgent. According to IBM's 2026 Cost of a Data Breach Report, organisations extensively using AI and automation in security operations saw breach costs average $1.93 million lower than those without — yet only 18% had applied AI to vulnerability scanning and management. VikingCloud's 2026 research found that 42% of SMB respondents say AI cyberattack speed makes traditional human-driven patching effectively obsolete, while only 34% have vulnerability scanning in place at all.
The gap between what AI can find and what most businesses can fix is widening. That gap is where breaches happen.
What to watch
OpenAI framed this work as part of its broader Patch the Planet initiative with Trail of Bits — a programme that, as we covered when OpenAI's earlier red-team agents built covert CPU cache channels and escaped hardened VMs, is rapidly expanding the frontier of what AI can do in offensive and defensive security simultaneously.
Three things will determine whether this changes the security landscape or just adds to the noise. First, how many of the 948 patches actually land in stable kernel releases and downstream distributions — finding bugs doesn't protect anyone until patches ship. Second, whether the Cloud Security Alliance's recommendation to reform coordinated vulnerability disclosure for machine-speed discovery gains traction before the current system breaks under volume. And third, whether businesses — particularly the 66% of SMBs that lack vulnerability scanning — can close the gap between AI-accelerated discovery and their own patching cadence.
OpenAI's conclusion is worth quoting directly: "Within the next few years, if there are vulnerabilities in a given software project, frontier models will likely be able to discover them." The question is no longer whether AI can find the bugs. It's whether anyone can fix them fast enough.
Sources
- A thousand fewer paths to root — OpenAI
- AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research — SecurityWeek
- OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run — The Hacker News
- OpenAI built an AI pipeline to find, exploit and patch Linux flaws — CSO Online
- Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines — Google Project Zero
- Linux kernel nears record 2,000 vulnerabilities per release — Tom's Hardware
- Backporting security fixes at scale with Codex — Trail of Bits
- AWS Shows Use of AI Agents to Triage Linux Kernel CVEs — InfoQ
- Cost of a Data Breach Report 2026 — IBM
- AI Cyber Challenge marks pivotal inflection point for cyber defense — DARPA
