OpenAI says an autonomous pipeline powered by an unreleased cyber model built working root exploits for 948 unique Linux kernel vulnerabilities during a single run that cost $1.2 million in API credits.
The mid-October scan targeted the most recent code in the kernel’s master branch. AI agents first narrowed the kernel down to security-relevant areas that low-privileged users can reach, then flagged 2,308 potential bugs and confirmed 1,724 of them.
Exploits were tested on virtual machines running an unmodified desktop Linux setup with common protections such as KASLR, SMEP and SMAP turned on. In total, the agents came up with 1,169 working local privilege escalation (LPE) exploits, along with 291 proofs of concept for information leaks.
OpenAI says the 948 figure reflects the number of separate patches created for the bugs behind those exploits. Before anything went to kernel maintainers, its security researchers checked the exploits and fixes, along with the severity the system proposed.
“To the best of our knowledge, the agents in this pipeline discovered and used at least 10 novel Linux exploitation techniques,” the company said. Kernel exploitation experts outside OpenAI weren’t familiar with them either, and the full technical details are being kept private for safety reasons.
Spread across the 948 exploits, the $1,213,430 bill comes to roughly $1,279 apiece. An earlier scan in late July, powered by GPT-5.6 Sol, yielded 166 unique LPEs at a cost of $513,690.
OpenAI puts the haul in perspective: at the $20,000 and $70,000 that Pwn2Own and TyphoonPWN have historically paid for Linux kernel privilege escalation exploits, the 948 bugs would be worth $18.9 million to $66.3 million, or 16 to 55 times what the scan cost.
OpenAI notes that the October scan uncovered more than five times as many new LPEs, even though the kernel had gone through three months of hardening in between.
The company also pointed the pipeline at an adapted version of Google’s kernelCTF, whose target kernel is hardened and exposes less attack surface. Over 112 hours and about $33,000 in API credits, it delivered 21 LPE exploits.
Acting on advice from the kernel community, OpenAI says it has already submitted hundreds of reports and patches for critical flaws. It will send fixes for the remaining bugs in stages, working with partners in its Patch the Planet initiative.
“Within 10 days while the scan was running, we observed over 100 Linux LPEs had been patched or had staging patches from other contributors, with ~300 more being publicly discussed,” OpenAI noted.
The company also warned defenders: “For the near and medium term, having access to a low-privileged account on an operating system, that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-re
To contain the damage when a flaw does get exploited, OpenAI points to layered defenses, including sandboxing and isolation technologies such as Firecracker and gVisor.
OpenAI raises bug bounty rewards
OpenAI separately announced on November 2 that it is increasing payouts in its Security Bug Bounty program. The goal is to get more outside researchers hunting for flaws that its own testing may have missed.
The company says the midpoint of its payout ranges for medium-, high- and critical-severity bugs is now more than four times higher on average. A researcher who reports a critical flaw in ChatGPT, Codex, the API Platform or another core product can now earn as much as $30,000.
The cap for exceptional critical bugs in those products stays at $100,000, but bonuses can now push a single payout to $172,000. OpenAI is adding bonuses for high-quality reports, a five-tier loyalty program for researchers who keep finding valid bugs, and extra multipliers for flaws reported during priority campaigns.
Related Content
Vulnerabilities
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Cisco patched an RCE in UCS Central Software; WatchGuard fixed authentication and MitM flaws.
Artificial Intelligence
The Agent Smith Dilemma: Governing Agentic Identities
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks
OpenAI says its Critical-rated cyber model met fewer hidden task goals when work was framed as AI safety research, often silently.
Application Security
Sysdig Adds Runtime Security and Governance for AI Agents
Sysdig’s platform uses runtime visibility to track AI agent actions and block risky behavior before it reaches production systems.
Email Security
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances.
Agentic Data Security Firm Sentra Raises $150 Million
The company will invest in agentic data security capabilities and expand its go-to-market organization.
AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks
Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks.
Vulnerabilities
Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.
