# OpenAI: an agent pipeline built 948 Linux root exploits in one run

> OpenAI's autonomous vulnerability pipeline turned 2,308 candidate Linux kernel findings into 948 working root exploits.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Lab safety
- **Published by:** OpenAI
- **Disclosed:** 2026-11-04
- **Affects:** Linux kernel, QEMU
- **Research by:** OpenAI Cyber team
- **Primary source:** https://openai.com/index/a-thousand-fewer-paths-to-root/
- **Page:** https://theinjection.dev/items/openai-thousand-fewer-paths-to-root/

OpenAI says an autonomous pipeline running an unreleased cyber model produced 948 working Linux kernel privilege escalation exploits in one mid-October run for $1,213,430 in API credits, with a candidate patch for each.

## What happened

OpenAI published "A thousand fewer paths to root" on 4 November 2026, describing a prototype pipeline it ran against the Linux kernel inside a controlled research environment. In a mid-October 2026 run, the pipeline analyzed 2,308 candidate findings, reproduced 1,724 vulnerabilities and produced 291 information leak proofs of concept alongside 948 local privilege escalation exploits. OpenAI says it has already sent hundreds of reports and patches for critical vulnerabilities to maintainers.

## How it works

Five stages run in sequence: Scout agents choose security-relevant audit targets, Analyst agents scan them for candidate findings, a triage stage reproduces each candidate in an isolated environment, ExploitDev agents try to reach a root shell, and a patch stage writes a fix before a human researcher reviews the result. Scout agents narrowed the search to 5,034 audit targets, about 2.8 million lines or roughly 7% of the kernel, which OpenAI says cut the cost of the audit.

## Who is affected

Linux kernel users are the subject of the run, which targeted the latest kernel on stock desktop virtual machines rather than a weakened target. OpenAI also reports that the pipeline found and exploited a QEMU TCG flaw during a separate kernelCTF campaign, already fixed upstream but not in the build it used. No individual vulnerability or CVE is named in the post.

## What to do

Keep operating systems patched: OpenAI writes that a low-privileged account on a system that is not up to date should be treated as functionally equivalent to root access for a well-resourced threat actor. The post recommends defense in depth through sandboxes and isolation such as Firecracker and gVisor, rescanning code already audited as models improve, and adversarial review of both human and AI-written patches.

## Unique Linux kernel LPE exploits produced

Higher means the model found more ways to reach root

| Result | Score |
|---|---|
| GPT-5.6 Sol, late July 2026 | 166 exploits |
| **Upcoming cyber model, mid-October 2026** (this story) | 948 exploits |

Source: https://openai.com/index/a-thousand-fewer-paths-to-root/

## Quick facts

- **Run date:** Mid-October 2026, against the latest Linux kernel
- **Candidate findings:** 2,308 after deduplication, within 12 hours
- **Reproduced:** 1,724 vulnerabilities
- **Exploits produced:** 948 local privilege escalation, 291 information leak PoCs
- **Cost:** $1,213,430 in API credits, $1,279 per LPE exploit
- **Patch status after 10 days:** 61 LPEs patched upstream, 43 with staging patches, 299 discussed publicly
- **Novel techniques:** 10 in a 166-exploit sample, per OpenAI

## Questions

### Does OpenAI name the 948 Linux kernel vulnerabilities it exploited?

OpenAI's post names no individual vulnerability and assigns no CVE. The company says it used the exploit evidence to prioritize reports, began with critical vulnerabilities on the Linux kernel community's advice, and is working with Patch the Planet partners to send the remaining reports and patches gradually. Full technical details of the 10 new exploitation techniques are withheld for safety reasons.

### Which model produced the 948 exploits?

An upcoming cyber model that OpenAI has not released powered the mid-October 2026 run. For comparison, OpenAI reports that GPT-5.6 Sol found and exploited 166 unique local privilege escalation vulnerabilities in late July 2026 for $513,690, and that the October pipeline discovered more than five times as many novel local privilege escalations despite three months of hardening in between.

### How reliable were the pipeline's own exploitation results?

Validation turned out to matter. OpenAI reports that an early run claimed 200 successful local privilege escalations, but human review found 20 of those had reached root through a different zero-day than the one assigned. OpenAI tightened the task constraints and added an independent check that each final exploit used its assigned vulnerability, concluding that agent output needs the path verified, not only the outcome.

## Sources

1. [OpenAI Research Post](https://openai.com/index/a-thousand-fewer-paths-to-root/)
2. [Patch the Planet](https://openai.com/index/patch-the-planet/)
3. [Google kernelCTF Rules](https://google.github.io/security-research/kernelctf/rules.html)