OpenAI says its AI pipeline built 948 Linux root exploits in 30 hours at $1,279 each

Nine hundred and forty-eight paths to root in thirty hours

Security research that once required a dedicated specialist several weeks of manual reverse engineering and memory debugging can now be executed as an industrial batch job.

OpenAI published a research paper titled A thousand fewer paths to root on 4 November 2026, documenting an end to end vulnerability discovery, validation, exploitation, and patching pipeline powered by an upcoming cyber foundation model. Operating inside an isolated research environment against a modern stock Linux distribution, the multi-agent system identified and analyzed 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities, and developed 948 working local privilege escalation (LPE) exploits that grant unprivileged users complete root control.

The entire campaign completed in 30 hours and consumed $1,213,430 in API credits. That expenditure yields a unit cost of $1,279 per functional root exploit (derived: $1,213,430 divided by 948 exploits), or $703.85 per dynamically verified memory corruption flaw (derived: $1,213,430 divided by 1,724 vulnerabilities). The generation velocity reached 31.6 working root exploits per hour, equivalent to producing a verified local privilege escalation chain every 113.9 seconds (derived).

The targets evaluated were not weakened test kernels or synthetic toy problems. The virtual machines executed a stock desktop operating system with standard contemporary defenses enabled, including Supervisor Mode Execution Prevention (SMEP), Supervisor Mode Access Prevention (SMAP), Kernel Address Space Layout Randomization (KASLR), and hardened usercopy restrictions. In addition to the 948 root exploits, the pipeline generated proofs of concept for 291 information leak vulnerabilities and synthesized 948 candidate source code patches for upstream maintainer review.

The five-stage autonomous exploitation pipeline

The architecture decomposes offensive security research into five distinct asynchronous agent tiers: discovery, dynamic validation, exploitability assessment, patch generation, and human review.

Execution stages, resource expenditure, and yield. Source: OpenAI Cyber Team.

Stage	Agent Roles and Environment	Cost (USD)	Output Yield	Key Metric
Stage 1: Discovery	Scout agents filter files; Analyst agents conduct static audit	$319,975	2,308 candidate findings	12 hour run; $525.75 per candidate (derived)
Stage 2: Validation	Triage agents run dynamic tests in isolated KASAN virtual machines	$73,330	1,724 verified vulnerabilities	74.7% accuracy; 3.1% false analysis rate
Stage 3: Exploitation	ExploitDev agents build chains under SMEP, SMAP, and KASLR	$820,123	948 working root LPEs, 291 leak PoCs	$1,279 per root exploit; $359 average successful build
Stage 4: Patching	Code agents synthesize patches matching kernel style and variants	Included in run	948 candidate source patches	Iterative prompt loop avoids code bloat
Stage 5: Upstream	Human security experts review severity and submit to maintainers	Human labor	Hundreds of reports dispatched	61 already patched; 43 in staging upstream

The discovery stage opened with Scout agents scanning the Linux kernel tree to identify audit targets reachable by unprivileged users. This reduced the audit scope to 5,034 targets comprising roughly 2.8 million lines of code (approximately 7% of the total 40-million-line codebase) at a cost of $3,426. Analyst agents then spent 12 hours performing static threat modeling and code review across these targets, generating 2,308 candidate findings for $316,549 in API credits.

In the validation phase, triage agents synthesized test programs and executed them inside virtual machines running the Kernel Address Sanitizer (KASAN). The agents monitored console outputs and system call returns, iteratively refining triggers until memory corruption occurred. Within 30 hours, 1,724 vulnerabilities were confirmed (74.7% of candidates). Crucially, only 3.1% of candidate findings reflected flawed model logic where an impossible precondition was assumed. The remaining unverified candidates failed due to narrow race condition windows, memory allocation failures, or timeout limits.

Zoom

Exploit economics: AI generation versus the zero-day market

OpenAI states that its research goal is to help defenders find and remediate vulnerabilities before attackers can weaponize them, making exploitation cost-prohibitive. However, placing the pipeline's $1,279 unit cost against competitive bug bounty programs and commercial zero-day broker pricing reveals extreme economic asymmetry.

Economic valuation of 948 Linux kernel root exploits across competitive and commercial markets. Source: OpenAI, Zerodium, Crowdfense, Pwn2Own.

Market / Program	Payout per LPE Exploit	Valuation (948 Exploits)	Cost to Generate	ROI / Asymmetry Ratio
OpenAI Pipeline (Full)	$1,279 per exploit	$1,213,430 total spend	$1,213,430	1.0x baseline cost
Google kernelCTF Program	$71,428 per exploit (derived)	$1,500,000 (21 exploits)	$32,936 (112 hours)	45.5x net return (derived)
Pwn2Own Competition Tier	$20,000 per exploit	$18,960,000	$1,213,430	15.6x cost multiplier (derived)
TyphoonPWN Contest Tier	$70,000 per exploit	$66,360,000	$1,213,430	54.7x cost multiplier (derived)
Commercial Broker Market	$50,000 to $250,000	$47.4M to $237.0M	$1,213,430	39.1x to 195.3x return (derived)

In a dedicated trial against Google's kernelCTF environment, which enforces hardened configurations and reduced attack surfaces, the pipeline ran for 112 hours at an API cost of $32,936. It produced 25 information leak proofs of concept and 21 fully working root exploits. For context, the entire kernelCTF program had accepted 26 confirmed zero-day exploits from all human contributors combined throughout 2026. If accepted, the 21 exploits would earn roughly $1.5 million in rewards, delivering a 45.5x return on investment (derived) at a unit generation cost of $1,568 per exploit (derived).

When evaluated against commercial zero-day acquisition firms such as Zerodium and Crowdfense, where reliable Linux local privilege escalation chains command between $50,000 and $250,000, the economic balance collapses. An automated system capable of delivering verified root exploits for $1,279 does not make attack development cost-prohibitive. Instead, it provides offensive organizations with a 39x to 195x return on capital (derived), transforming exploit generation from a boutique artisanal craft into high-yield algorithmic manufacturing.

Zoom

Ten novel exploitation primitives discovered by AI agents

A common critique of large language models in offensive security has been that they merely recite known proof of concept patterns and fail when confronting modern kernel mitigations. OpenAI sampled 166 exploits generated by the pipeline and conducted a manual autopsy of the underlying exploitation techniques. Independent third-party kernel security experts reviewed the mechanisms and confirmed that the agents had invented 10 novel exploitation primitives.

Categorization of the ten novel exploitation primitives discovered by the cyber model. Source: OpenAI.

Category	Count	Mechanism and Tactical Function	Mitigation Impact
Persistent Elastic Objects	2 primitives	Sprays controlled objects inside target kernel cache slabs to establish predictable heap layout	Bypasses modern SLUB randomization without triggering worker thread crashes
Page Grooming Techniques	2 primitives	Synchronizes multi-threaded worker queues to force deterministic page ordering across race windows	Stabilizes tight microsecond race conditions into repeatable exploit chains
Data-Only Escalation	5 primitives	Directly overwrites process credentials (struct cred) or kernel state variables via arbitrary write	Completely defeats Control Flow Integrity (CFI) and SMEP by executing zero code
Arbitrary Type Confusion	1 primitive	Forces kernel subsystems to misinterpret allocated memory structures, bridging network and file subsystems	Provides reliable arbitrary read and write primitives while bypassing KASLR

Five of the 10 primitives represent data-only attacks. Rather than attempting to hijack instruction pointers, redirect control flow, or execute kernel Return-Oriented Programming (ROP) chains, these exploits locate the current process credential structure (struct cred) in memory and overwrite the effective UID, GID, and capability bitmasks with zeroes. Because no executable code is injected and no call stack pointers are corrupted, contemporary kernel protections like Control Flow Integrity (CFI), Kernel Control Flow Guard, and Supervisor Mode Execution Prevention (SMEP) remain inert.

The persistence of two newly identified elastic objects allows attackers to groom the Linux slab allocator across long execution cycles without triggering garbage collection reclamation. OpenAI noted that full technical specifications and proof of concept code for these 10 primitives were withheld from the publication to prevent weaponization by threat actors.

Zoom

Technical details: the wrong zero-day, QEMU bugs, and model evolution

The research paper documents three remarkable technical phenomena encountered during autonomous execution that illuminate the operational realities of agent-driven offensive research.

First, the paper reveals the wrong zero-day problem. During an early execution run, ExploitDev agents reported 200 successful root exploits. Upon detailed manual triage, OpenAI engineers discovered that in 20 of those instances (10% of successes), the agent had successfully spawned a root shell by discovering and exploiting a completely different, unassigned zero-day vulnerability in the kernel rather than the candidate flaw it was instructed to weaponize. The system was subsequently updated with independent path verification checks to ensure that exploits strictly traverse the assigned vulnerability.

Second, the pipeline demonstrated the ability to compromise virtualization hypervisor infrastructure. During the kernelCTF campaign, an analyst agent assigned to inspect system call entry points encountered an unexpected kernel crash. Without access to source code for the virtualization layer, the agent triaged the crash, traced the fault to a memory bug inside the QEMU Tiny Code Generator (TCG), and drafted a vulnerability report. The ExploitDev agent subsequently synthesized a working local privilege escalation exploit targeting the QEMU hypervisor component. OpenAI verified that while upstream QEMU had recently fixed the issue, the release package deployed in their testing harness remained vulnerable.

Third, the paper provides comparative telemetry measuring model capability growth over a three-month window. In late July 2026, an experimental run using GPT-5.6 Sol yielded 166 unique root exploits for $513,690 in API credits ($3,094.52 per exploit (derived)). In mid-October 2026, the upcoming cyber model produced 948 unique root exploits for $1,213,430 ($1,279.99 per exploit (derived)). This represents a 5.71x increase in exploit volume (derived) and a 58.6% reduction in cost per working root exploit (derived), despite three months of upstream security hardening by Linux kernel maintainers.

The researchers also discovered that more capable foundation models require substantially lighter prompt scaffolding. When testing GPT-5.5 Cyber, the model struggled to identify appropriate exploitation primitives. Providing a heavily structured library of 103 documented kernel techniques raised its success rate from 76.2% to 88.9%. However, when the newer GPT-5.6 Cyber was tested, it intuitively discovered and applied techniques without external guidance. Adding the heavy scaffolding layer to GPT-5.6 provided only a marginal 1.5 percentage-point increase, prompting OpenAI to discard the complex orchestration layer entirely.

What the paper states versus what remains unstated

Rigorous threat intelligence requires distinguishing verified disclosures from selective vendor omissions. While OpenAI provides unprecedented visibility into run costs and high-level counts, several critical operational variables are withheld.

Comparison of stated claims versus unstated technical and commercial details. Source: Analysis of primary paper.

Dimension	What OpenAI Explicitly States	What the Paper Leaves Unstated
Target Distribution	A stock desktop operating system running standard mitigations	The exact Linux distribution, release version, and kernel branch tested
Kernel Versioning	Conducted on the latest Linux kernel master branch in mid-October 2026	Whether enterprise long-term support (LTS) kernels were evaluated
Model Identity	An upcoming cyber model compared against GPT-5.6 Sol and GPT-5.5 Cyber	The commercial product name, parameter scale, or release timeline for the model
Maintainer Acceptance	Sent out hundreds of reports and patches for critical vulnerabilities	The exact number of candidate patches accepted, rejected, or revised by maintainers
Exploit Custody	Exploits used to validate severity and assist upstream maintainer review	Where the 948 working exploit scripts and binaries are stored and how access is audited
Economic Reality	Asserts high costs will deter attackers and make exploitation prohibitive	Why $1,279 is considered a deterrent when zero-day brokers pay $100,000+ per exploit

The omission of specific kernel versions and distributions complicates defensive assessment. If the 948 flaws concentrate primarily in experimental subsystem drivers or newly introduced staging features, enterprise server distributions like Debian, Ubuntu LTS, and RHEL may be insulated from the vast majority of findings. Conversely, if the vulnerabilities reside in core memory management, networking sockets, or POSIX system calls, the blast radius encompasses virtually every modern cloud workload.

Furthermore, OpenAI asserts that its Daybreak initiative and Patch the Planet program are helping defenders secure open source software. Yet the physical custody and retention policies governing 948 working, weaponized root exploits remain unspecified. In an era where state-backed threat actors routinely target AI research infrastructure, a repository containing nearly a thousand fresh Linux zero-days constitutes a high-priority counterintelligence target.

Defensive imperative: unpatched access is functionally root

The central operational takeaway from OpenAI's research is stark: for the near and medium term, having access to an unprivileged account on an operating system that is not current on patches must be considered functionally equivalent to root access.

Linux maintainers are moving with extraordinary speed. During the 10 days of active autonomous scanning and manual triage, maintainers had already merged fixes for 61 of the discovered LPEs, placed 43 into staging trees, and were actively reviewing 299 others in public mailing lists. However, downstream distribution lag means that weeks or months elapse before patches propagate to enterprise servers, container hosts, and end-user devices.

For enterprise defense teams, this research marks a permanent inflection point. Relying on traditional vulnerability discovery timelines or assuming that low-privilege container breakouts require months of advanced exploit development is obsolete. Security leaders must implement three immediate architectural controls:

First, enforce micro-virtualization isolation boundaries. Standard container isolation (cgroups and Linux namespaces) shares the underlying kernel attack surface. Workloads executing untrusted code or processing external data must be wrapped in hardware-assisted micro-VMs such as Firecracker or user-space kernel emulators like gVisor.

Second, minimize attack surfaces aggressively. Audit kernels to disable unneeded legacy networking protocols, unusual filesystems, and unprivileged user namespaces (kernel.unprivileged_userns_clone = 0).

Third, compress the patch deployment lifecycle. When adversarial AI pipelines can synthesize reliable root exploits for $1,279 in under two minutes, 30-day enterprise patching SLAs are no longer viable defensive postures.

Key facts at a glance