OpenAI: an agent pipeline built 948 Linux root exploits in one run

01What happened

OpenAI published "A thousand fewer paths to root" on 4 November 2026, describing a prototype pipeline it ran against the Linux kernel inside a controlled research environment. In a mid-October 2026 run, the pipeline analyzed 2,308 candidate findings, reproduced 1,724 vulnerabilities and produced 291 information leak proofs of concept alongside 948 local privilege escalation exploits. OpenAI says it has already sent hundreds of reports and patches for critical vulnerabilities to maintainers.

02How it works

Five stages run in sequence: Scout agents choose security-relevant audit targets, Analyst agents scan them for candidate findings, a triage stage reproduces each candidate in an isolated environment, ExploitDev agents try to reach a root shell, and a patch stage writes a fix before a human researcher reviews the result. Scout agents narrowed the search to 5,034 audit targets, about 2.8 million lines or roughly 7% of the kernel, which OpenAI says cut the cost of the audit.

03Who is affected

Linux kernel users are the subject of the run, which targeted the latest kernel on stock desktop virtual machines rather than a weakened target. OpenAI also reports that the pipeline found and exploited a QEMU TCG flaw during a separate kernelCTF campaign, already fixed upstream but not in the build it used. No individual vulnerability or CVE is named in the post.

04What to do

Keep operating systems patched: OpenAI writes that a low-privileged account on a system that is not up to date should be treated as functionally equivalent to root access for a well-resourced threat actor. The post recommends defense in depth through sandboxes and isolation such as Firecracker and gVisor, rescanning code already audited as models improve, and adversarial review of both human and AI-written patches.

Measured results

Questions people ask

Does OpenAI name the 948 Linux kernel vulnerabilities it exploited?

OpenAI's post names no individual vulnerability and assigns no CVE. The company says it used the exploit evidence to prioritize reports, began with critical vulnerabilities on the Linux kernel community's advice, and is working with Patch the Planet partners to send the remaining reports and patches gradually. Full technical details of the 10 new exploitation techniques are withheld for safety reasons.

Which model produced the 948 exploits?

An upcoming cyber model that OpenAI has not released powered the mid-October 2026 run. For comparison, OpenAI reports that GPT-5.6 Sol found and exploited 166 unique local privilege escalation vulnerabilities in late July 2026 for $513,690, and that the October pipeline discovered more than five times as many novel local privilege escalations despite three months of hardening in between.

How reliable were the pipeline's own exploitation results?

Validation turned out to matter. OpenAI reports that an early run claimed 200 successful local privilege escalations, but human review found 20 of those had reached root through a different zero-day than the one assigned. OpenAI tightened the task constraints and added an independent check that each final exploit used its assigned vulnerability, concluding that agent output needs the path verified, not only the outcome.

Sources 3 links, all fetched

1. 1openai.comOpenAI Research Post
2. 2openai.comPatch the Planet
3. 3google.github.ioGoogle kernelCTF Rules