OpenAI says AI pipeline uncovered 948 exploitable Linux kernel flaws

OpenAI said on November 4 that an autonomous security-research pipeline produced 1,169 successful local privilege-escalation exploit runs during a mid-October Linux kernel audit. The company said variant analysis grouped those runs behind 948 distinct patches, which it used as the basis for claiming 948 unique local privilege-escalation vulnerabilities.

The company has not published a vulnerability-by-vulnerability ledger, commit list or reproducible corpus that would allow the aggregate figure to be independently verified. It also did not identify the stock Linux distribution or configuration on which it said the exploits let an unprivileged local user gain root access.

OpenAI’s technical announcement said the system selected 5,034 audit targets spanning about 2.8 million lines of code, or roughly 7% of the kernel, and produced 2,308 deduplicated candidate findings within 12 hours. It said virtual machines with the Kernel Address Sanitizer enabled then reproduced 1,724 candidates within 30 hours. The pipeline also produced 291 information-leak proofs of concept, according to the company.

The pipeline had five stages. Scout agents selected kernel areas for review, and Analyst agents examined those targets for possible flaws. The system then tried to reproduce each candidate in an isolated virtual machine, assessed whether a confirmed flaw could be turned into an exploit and generated a candidate patch. Human reviewers checked completed bundles before reports went to maintainers; a bundle could include root-cause analysis, a crashing proof of concept, a candidate patch and a full exploit.

That review caught a material attribution problem in an earlier run. OpenAI said the system initially counted 200 successful privilege-escalation exploits, but reviewers found that 20 used a different zero-day from the flaw each agent had been assigned. The company added an independent path check before the larger campaign.

OpenAI said that by the end of the 10-day scan and analysis period, 61 of the claimed flaws had been patched upstream, 43 had patches in staging and 299 were under public discussion. It did not provide an itemized mapping between those figures and public commits or mailing-list threads. Nor did it say that all 948 candidate patches had been accepted, merged, released by Linux distributions or deployed by users.

The Linux kernel security-reporting guidance requires reports to identify an affected version, describe the issue, provide a reproducer when possible and state the conditions that trigger it. The guidance distinguishes a proposed fix from an accepted one and warns that poorly verified AI-assisted reports can burden maintainers. OpenAI said human review takes place before its reports are sent to maintainers.

OpenAI reported spending $1,213,430 in API credits on the run, or $1,279 per claimed unique local privilege-escalation flaw, with successful exploit development averaging $359. Those accounting figures, like the aggregate vulnerability and exploit totals, are company-reported.

OpenAI previously said in its Patch the Planet announcement that a GPT-5.5 Cyber effort produced 24 Linux local privilege-escalation exploits. Earlier DataPhoenix coverage of the program’s response to two PHP flaws provides context on its work with open-source maintainers.

In a separate adapted kernelCTF test, OpenAI said the upcoming model produced 21 local privilege-escalation exploits after one incompatible mitigation was removed. Google’s kernelCTF rules describe a hardened target with a reduced attack surface and require later verification of patches and exploits, but they do not show that OpenAI’s 21 results were submitted or accepted.