Skip to content
Hire an AI employee
AI EmployeeSuper-AgentsAgent-to-AgentBenchmarksPricingBlog
Guides 07 Trust, permissions & security

OpenAI Agents Found 948 Linux Root Exploits for $1.2M

Nitish Garg · Founder & CEO, CellCog · 04 November 2026 · 6 min read · 1,177 words
At a glanceQuick answers
What did OpenAI do?
It ran an autonomous pipeline that scanned the Linux kernel, reproduced 1,724 vulnerabilities, built 948 working root exploits and wrote patches for them.
What did it cost?
$1,213,430 in API credits for the main run, about $1,279 per root exploit. A successful exploit averaged $359 to develop.
Are the bugs being fixed?
OpenAI says it has sent hundreds of reports and patches for critical vulnerabilities to Linux maintainers, with the rest going out through its Patch the Planet partners.
Editorial data illustration on a near-white ground: a tall navy server stack with hundreds of small teal keyholes, one large amber key turning in the centre, beside the large figures 948 and $1.2M with the small labels ROOT EXPLOITS and API CREDITS
Fig 0948 ways to root, found by agents for $1.2M. Made by CellCog's image agent, running GPT Image 2.5.

OpenAI published the numbers behind an autonomous vulnerability pipeline on November 4, 2026: in one run against the Linux kernel it produced “948 local privilege escalation (LPE) exploits that could allow an unprivileged local user to gain root access”, plus 291 information-leak proofs of concept, for $1,213,430 in API credits.

That is $1,279 per root exploit, found and weaponised by agents with no human in the loop until the review step. The same pipeline wrote candidate patches for every one, and OpenAI says it has already sent hundreds of reports and fixes to Linux maintainers.

On this page · 7 sectionsOpen
  1. What the run produced
  2. The cost comparison OpenAI drew
  3. Better models, many more bugs
  4. What it says to defenders
  5. What is not in the post
  6. Agents at this scale need a leash
  7. Sources
Key points5 · 6 min full read
  1. A padlock opening above a server stack.
    OpenAI said on November 4, 2026 that an autonomous pipeline produced 948 working Linux local privilege escalation exploits, each giving an unprivileged user root.
  2. A stack of coins beside a price tag.
    The run cost $1,213,430 in API credits, about $1,279 per root exploit; a successful exploit averaged $359.
  3. Two bars, the right one much taller.
    Against the same harness in July, GPT-5.6 Sol found 166; the October run with an unnamed newer cyber model found 948.
  4. A bandage over a cracked code bracket.
    The pipeline also wrote patches; OpenAI says hundreds of reports and fixes have gone to Linux maintainers already.
  5. A door left ajar with a key in the lock.
    OpenAI’s advice: treat a low-privileged account on an unpatched machine as effectively root for a well-resourced attacker.

§ 01What the run produced

The pipeline ran in mid-October against the kernel’s master branch, using what OpenAI calls “an upcoming cyber model”. Scout agents picked the parts of the kernel worth auditing, analyst agents read them for flaws, triage agents reproduced each candidate in a virtual machine, exploit agents tried to turn the real ones into root, and a patch stage wrote fixes. Humans reviewed at the end.

Animated diagram: a funnel narrowing from 5,034 audit targets through 2,308 candidates, 1,724 reproduced and 1,238 LPE candidates to 948 root exploits in amber, with a cost strip below showing scouting $3K, analysis $317K, validation $73K, screening $44K and exploits $776K totalling $1.2M, and the label $1,279 per exploit
Fig 1Thousands of candidates narrowed to 948 root exploits, and what each stage cost
Stage Result API cost
Scout agents 5,034 audit targets, about 2.8M lines, roughly 7% of the kernel $3,426
Analyst agents 2,308 candidate findings in 12 hours $316,549
Validation 1,724 reproduced in 30 hours, 74.7% of candidates $73,330
Screening 313 info-leak and 1,238 privilege-escalation candidates $44,194
Exploit development 291 info-leak PoCs, 1,169 working LPE exploits, 948 distinct patched vulnerabilities $775,929
Whole run 948 unique root exploits $1,213,430
Table 1OpenAI’s Linux kernel run, mid-October 2026 (OpenAI, November 4, 2026)
Where the $1.2M went, by pipeline stage, in thousands of dollarsBar chart in thousands of dollars: exploit development 776 highlighted, analysis 317, validation 73, screening 44, scouting 3Exploit development776Analysis317Validation73Screening44Scouting3Where the $1.2M went, by pipeline stage, in thousands of dollarsBar chart in thousands of dollars: exploit development 776 highlighted, analysis 317, validation 73, screening 44, scouting 3Exploit development776Analysis317Validation73Screening44Scouting3
Fig 2Where the $1.2M went, by pipeline stage, in thousands of dollars

The target was “a stock desktop operating system, not a weakened target”, with SMEP, SMAP, KASLR and hardened usercopy on. A successful exploit cost $359 on average; the failures cost far more, $3,922 each across 69 cases, because a few race conditions ate time.

§ 02The cost comparison OpenAI drew

OpenAI priced its own work against what the same bugs fetch at competitions. Pwn2Own and TyphoonPWN have historically paid $20,000 and $70,000 for a Linux kernel LPE, which it puts at $18.9M to $66.3M, “approximately 16x to 55x our pipeline’s cost.”

On Google’s hardened kernelCTF target the pipeline got 21 LPE exploits and 25 info leaks for about $32,936. For scale, OpenAI notes that kernelCTF accepted 26 confirmed 0-day LPE exploits in all of 2026 so far.

Target Root exploits Cost in API credits
Stock Linux distribution 948 $1,213,430
kernelCTF hardened kernel 21 about $32,936
Table 2The same pipeline on two targets (OpenAI, November 4, 2026)

OpenAI adds that it optimised for measurement, not price: “sufficient harness engineering could meaningfully reduce the cost at each stage”, so these figures are an upper bound.

§ 03Better models, many more bugs

The same harness ran in late July with GPT-5.6 Sol: 166 unique LPE vulnerabilities for $513,690. Three months and one model later, on a kernel that had been hardened in between, the count went to 948.

Unique Linux root exploits found by one pipeline, by modelBar chart: GPT-5.6 Sol in July 166, upcoming cyber model in October 948 highlightedGPT-5.6 Sol, July166Upcoming cyber model, October948Unique Linux root exploits found by one pipeline, by modelBar chart: GPT-5.6 Sol in July 166, upcoming cyber model in October 948 highlightedGPT-5.6 Sol, July166Upcoming cyber model, October948
Fig 3Unique Linux root exploits found by one pipeline, by model

OpenAI’s reading: “A more capable model may uncover vulnerabilities that earlier models missed, even when using the same research harness.” It also says the agents used at least 10 exploitation techniques that were new to the third-party kernel experts it showed them to, including new object-spraying and page-grooming methods.

§ 04What it says to defenders

The blunt line is in OpenAI’s own reflections: “having access to a low-privileged account on an operating system, that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.” Its advice is sandboxing and isolation (it names Firecracker and gVisor), rescanning old code with each new model generation, and automated patch generation to keep pace.

Linux maintainers moved fast during the run. Within the 10 days the scan took, 61 of the found LPEs were already patched upstream by others, 43 had staging patches, and 299 were being publicly discussed.

§ 05What is not in the post

  • Which model. It is only “an upcoming cyber model”, unnamed and unreleased.
  • The new techniques. OpenAI withheld the technical details “for safety reasons”.
  • How many patches were accepted. It says hundreds of reports and patches went out for critical vulnerabilities, with the rest going out gradually through Patch the Planet partners.
  • Whether anyone outside OpenAI can run this. The pipeline is described as a prototype in a controlled research environment.

§ 06Agents at this scale need a leash

The same capability reads two ways: a defender who can afford $1.2M in credits can harden a codebase, and an attacker with similar resources gets 948 ways into an unpatched machine. Either way the practical control is the one OpenAI names, isolation and least privilege. CellCog’s AI employees each run on their own secure computer, and every action above the level you set waits for your approval.

§ 07Sources

Frequently asked5 questions

Q1Which model did OpenAI use?

It only says an upcoming cyber model. The July comparison run used GPT-5.6 Sol and found 166 unique privilege-escalation vulnerabilities.

Q2Was the target a weakened system?

No. OpenAI says the virtual machines ran a stock desktop operating system with SMEP, SMAP, KASLR and hardened usercopy enabled.

Q3How does the cost compare to bug bounties?

OpenAI applies historical Pwn2Own and TyphoonPWN payouts of $20,000 and $70,000 to the 948 exploits, a hypothetical $18.9M to $66.3M, or 16x to 55x the run’s cost.

Q4Did the agents invent new techniques?

OpenAI says that in a sample of 166 exploits the agents used 10 exploitation techniques that were new to the third-party kernel experts it consulted. The details are withheld.

Q5What should defenders do?

OpenAI recommends keeping systems patched, sandboxing and isolation such as Firecracker and gVisor, rescanning code with each new model generation, and automated patching.

Published 04 November 2026 All Trust, permissions & security →