# OpenAI Agents Found 948 Linux Root Exploits for $1.2M

> OpenAI's autonomous pipeline produced 948 working Linux privilege-escalation exploits plus patches for $1,213,430, or $1,279 each. The full cost breakdown.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-11-04
- Canonical (HTML): https://cellcog.ai/blog/openai-948-linux-root-exploits/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- OpenAI said on November 4, 2026 that an autonomous pipeline produced 948 working Linux local privilege escalation exploits, each giving an unprivileged user root.
- The run cost $1,213,430 in API credits, about $1,279 per root exploit; a successful exploit averaged $359.
- Against the same harness in July, GPT-5.6 Sol found 166; the October run with an unnamed newer cyber model found 948.
- The pipeline also wrote patches; OpenAI says hundreds of reports and fixes have gone to Linux maintainers already.
- OpenAI's advice: treat a low-privileged account on an unpatched machine as effectively root for a well-resourced attacker.

## At a glance

- **What did OpenAI do?** It ran an autonomous pipeline that scanned the Linux kernel, reproduced 1,724 vulnerabilities, built 948 working root exploits and wrote patches for them.
- **What did it cost?** $1,213,430 in API credits for the main run, about $1,279 per root exploit. A successful exploit averaged $359 to develop.
- **Are the bugs being fixed?** OpenAI says it has sent hundreds of reports and patches for critical vulnerabilities to Linux maintainers, with the rest going out through its Patch the Planet partners.

OpenAI published the numbers behind an autonomous vulnerability pipeline on November 4, 2026: in one run against the Linux kernel it produced "948 local privilege escalation (LPE) exploits that could allow an unprivileged local user to gain root access", plus 291 information-leak proofs of concept, for $1,213,430 in API credits.

That is $1,279 per root exploit, found and weaponised by agents with no human in the loop until the review step. The same pipeline wrote candidate patches for every one, and OpenAI says it has already sent hundreds of reports and fixes to Linux maintainers.

## What the run produced

The pipeline ran in mid-October against the kernel's master branch, using what OpenAI calls "an upcoming cyber model". Scout agents picked the parts of the kernel worth auditing, analyst agents read them for flaws, triage agents reproduced each candidate in a virtual machine, exploit agents tried to turn the real ones into root, and a patch stage wrote fixes. Humans reviewed at the end.

![Animated diagram: a funnel narrowing from 5,034 audit targets through 2,308 candidates, 1,724 reproduced and 1,238 LPE candidates to 948 root exploits in amber, with a cost strip below showing scouting $3K, analysis $317K, validation $73K, screening $44K and exploits $776K totalling $1.2M, and the label $1,279 per exploit](https://cellcog.ai/blog/media/openai-948-linux-root-exploits/root-funnel.svg)
*Thousands of candidates narrowed to 948 root exploits, and what each stage cost*

*Table: OpenAI's Linux kernel run, mid-October 2026 (OpenAI, November 4, 2026)*

| Stage | Result | API cost |
|---|---|---|
| Scout agents | 5,034 audit targets, about 2.8M lines, roughly 7% of the kernel | $3,426 |
| Analyst agents | 2,308 candidate findings in 12 hours | $316,549 |
| Validation | 1,724 reproduced in 30 hours, 74.7% of candidates | $73,330 |
| Screening | 313 info-leak and 1,238 privilege-escalation candidates | $44,194 |
| Exploit development | 291 info-leak PoCs, 1,169 working LPE exploits, 948 distinct patched vulnerabilities | $775,929 |
| Whole run | 948 unique root exploits | $1,213,430 |

The target was "a stock desktop operating system, not a weakened target", with SMEP, SMAP, KASLR and hardened usercopy on. A successful exploit cost $359 on average; the failures cost far more, $3,922 each across 69 cases, because a few race conditions ate time.

## The cost comparison OpenAI drew

OpenAI priced its own work against what the same bugs fetch at competitions. [Pwn2Own](https://www.zerodayinitiative.com/blog/2026/pwn2own) and TyphoonPWN have historically paid $20,000 and $70,000 for a Linux kernel LPE, which it puts at $18.9M to $66.3M, "approximately 16x to 55x our pipeline's cost."

On Google's hardened [kernelCTF](https://google.github.io/security-research/kernelctf/rules.html) target the pipeline got 21 LPE exploits and 25 info leaks for about $32,936. For scale, OpenAI notes that kernelCTF accepted 26 confirmed 0-day LPE exploits in all of 2026 so far.

*Table: The same pipeline on two targets (OpenAI, November 4, 2026)*

| Target | Root exploits | Cost in API credits |
|---|---|---|
| Stock Linux distribution | 948 | $1,213,430 |
| kernelCTF hardened kernel | 21 | about $32,936 |

OpenAI adds that it optimised for measurement, not price: "sufficient harness engineering could meaningfully reduce the cost at each stage", so these figures are an upper bound.

## Better models, many more bugs

The same harness ran in late July with GPT-5.6 Sol: 166 unique LPE vulnerabilities for $513,690. Three months and one model later, on a kernel that had been hardened in between, the count went to 948.

OpenAI's reading: "A more capable model may uncover vulnerabilities that earlier models missed, even when using the same research harness." It also says the agents used at least 10 exploitation techniques that were new to the third-party kernel experts it showed them to, including new object-spraying and page-grooming methods.

## What it says to defenders

The blunt line is in OpenAI's own reflections: "having access to a low-privileged account on an operating system, that isn't up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor." Its advice is sandboxing and isolation (it names [Firecracker](https://firecracker-microvm.github.io/) and [gVisor](https://gvisor.dev/)), rescanning old code with each new model generation, and automated patch generation to keep pace.

Linux maintainers moved fast during the run. Within the 10 days the scan took, 61 of the found LPEs were already patched upstream by others, 43 had staging patches, and 299 were being publicly discussed.

## What is not in the post

- **Which model.** It is only "an upcoming cyber model", unnamed and unreleased.
- **The new techniques.** OpenAI withheld the technical details "for safety reasons".
- **How many patches were accepted.** It says hundreds of reports and patches went out for critical vulnerabilities, with the rest going out gradually through Patch the Planet partners.
- **Whether anyone outside OpenAI can run this.** The pipeline is described as a prototype in a controlled research environment.

## Agents at this scale need a leash

The same capability reads two ways: a defender who can afford $1.2M in credits can harden a codebase, and an attacker with similar resources gets 948 ways into an unpatched machine. Either way the practical control is the one OpenAI names, isolation and least privilege. CellCog's AI employees each run on their own secure computer, and every action above the level you set waits for your approval.

## Sources

- OpenAI, [A thousand fewer paths to root](https://openai.com/index/a-thousand-fewer-paths-to-root), November 4, 2026 (RSS 08:00 UTC), read in full.
- OpenAI, [news RSS feed](https://openai.com/news/rss.xml), read November 4, 2026, 22:32 UTC.
- Google, [kernelCTF rules](https://google.github.io/security-research/kernelctf/rules.html), read November 4, 2026.

## FAQ

**Which model did OpenAI use?**

It only says an upcoming cyber model. The July comparison run used GPT-5.6 Sol and found 166 unique privilege-escalation vulnerabilities.

**Was the target a weakened system?**

No. OpenAI says the virtual machines ran a stock desktop operating system with SMEP, SMAP, KASLR and hardened usercopy enabled.

**How does the cost compare to bug bounties?**

OpenAI applies historical Pwn2Own and TyphoonPWN payouts of $20,000 and $70,000 to the 948 exploits, a hypothetical $18.9M to $66.3M, or 16x to 55x the run's cost.

**Did the agents invent new techniques?**

OpenAI says that in a sample of 166 exploits the agents used 10 exploitation techniques that were new to the third-party kernel experts it consulted. The details are withheld.

**What should defenders do?**

OpenAI recommends keeping systems patched, sandboxing and isolation such as Firecracker and gVisor, rescanning code with each new model generation, and automated patching.

## Related

- [Claude Chained 4 Bugs Into a Chrome Exploit](https://cellcog.ai/blog/claude-finds-chrome-safari-exploits/index.md)
- [Least Privilege for AI Agents: A Practical Access Model](https://cellcog.ai/blog/least-privilege-for-ai-agents/index.md)
- [OpenAI: GPT-6 Astra Quietly Underperforms on Safety Work](https://cellcog.ai/blog/gpt-6-astra-safety-underperformance/index.md)
- [Subagents: AI Employees Hand Work to Claude Code and Codex](https://cellcog.ai/blog/ai-employee-subagents/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/openai-948-linux-root-exploits/. Try CellCog free, no credit card needed: https://cellcog.ai/signup