OpenAI found 948 local privilege escalation vulnerabilities in Linux

In a report published on November 4, OpenAI announced that an AI-assisted prototype pipeline found and exploited 948 distinct local privilege escalation vulnerabilities in the Linux kernel during a research run in mid-October 2026. Vulnerabilities like these can allow an ordinary user with an account on the system to gain root privileges.

The tests were not run against an intentionally weakened target, but on isolated virtual machines running a stock desktop operating system with SMEP, SMAP, KASLR, and HARDENED_USERCOPY protections enabled. OpenAI chose Linux for this work: the kernel contains more than 40 million lines of code and underpins everything from Android devices to cloud infrastructure and supercomputers.

A pipeline from discovery to working exploit

The system works through several roles operating together. Scout agents select security-critical sections of code that low-privilege users can access. Analyst agents scan those targets. Triage agents then generate and validate proof-of-concepts on Kernel Address Sanitizer-enabled kernels, so the result does not rely only on static analysis and also includes runtime evidence. Each completed research package includes root cause analysis, minimal crash proof, a patch candidate, and a full exploit.

The numbers show the scale: the Scouts selected 5,034 audit targets covering about 2.8 million lines, which corresponds to roughly 7% of the kernel. Within 12 hours, the Analysts produced 2,308 deduplicated candidate findings, and dynamic validation reproduced 1,724 vulnerabilities in 30 hours. Most of the remaining findings were discarded because they required high privileges or could not be reproduced within the allotted time; only 3.1% of the findings turned out to be faulty model analysis.

The exploitation phase produced 291 information leak proofs and 1,169 working local privilege escalation exploits. After variant analysis, the total came to 948 different patches; OpenAI uses that number as the count of unique vulnerabilities, so it does not map one-to-one with the total number of exploits.

The patches are still candidates, not merged

The generated fixes are candidates awaiting maintainer review. OpenAI says it has submitted hundreds of reports and patches for critical vulnerabilities, and that it will gradually forward the rest through its Patch the Planet partners. In its Daybreak initiative, launched with Trail of Bits in June 2026, the company combines AI-assisted research with expert review; patch distribution and disclosure control remain in the hands of maintainers.

The report shows that after ten days of scanning and manual analysis, 61 vulnerabilities had already been patched upstream, 43 were preparatory patches, and 299 had already been publicly reported or discussed. OpenAI therefore recommends revalidating the findings against current code; the goal is to focus on unresolved vulnerabilities without overwhelming maintainers with unnecessary review work.

Human oversight also caught an error that simply looking for a root shell would have hidden. Of 200 exploits initially counted as successful in an early run, 20 had gained root through a different zero-day rather than the vulnerability assigned to them. In response, the task constraints were tightened and independent checks were added for the path each exploit took.

Cost and comparison with the previous run

The October run consumed $1.213 million in API credits, which works out to $1,279 per unique vulnerability. In the GPT-5.6 Sol run at the end of July, 166 vulnerabilities had been found at a cost of $513,690. Over the three months in between, the number of new vulnerabilities increased more than fivefold even though the kernel had been hardened further. OpenAI presents these figures as an upper bound, since the research was intended to measure method and capability rather than optimize cost.

The company says that among 166 reviewed exploits, it identified ten techniques that both its own team and independent kernel experts considered new: persistent elastic objects, page staging, data-oriented privilege escalation, and arbitrary type confusion are among them. Technical details were not shared for security reasons.

In an adapted kernelCTF run, meanwhile, the system produced 25 information leak proofs and 21 local privilege escalation exploits in 112 hours, at a cost of about $32,936 in API credits.

The bottleneck is now at the proof stage

The results shift where the problem now bottlenecks. AI no longer struggles to generate findings; the real work is proving the exploitation path, keeping findings current, and producing patches maintainers can accept. Without independent validation and human review, automated research at this scale risks turning into a new reporting burden rather than a contribution to defense.

Source: Unite.AI