OpenAI says an autonomous pipeline built on its unreleased cyber model found, proved and patched 948 unique ways for an ordinary user to take full control of a Linux machine. The API bill was $1,213,430. The bugs are local privilege escalation flaws: an attacker who already holds a low-privileged account climbs to root. OpenAI described the mid-October run on 4 November 2026 in a security post titled “A thousand fewer paths to root.”
The funnel is where the money went. Scout agents chose 5,034 places to audit, covering around 2.8 million lines and about 7% of the kernel, and that step cost $3,426. Analyst agents spent 12 hours on those targets and, once duplicates were removed, handed back 2,308 candidate flaws for $316,549. Then a triage agent built a working test for each candidate and ran it inside a sealed virtual machine. In 30 hours, 1,724 of them reproduced, about 74.7%. OpenAI puts incorrect analysis by the model at 3.1%.
The counts shrink twice more, so they are worth keeping straight. A screening agent narrowed the reproduced bugs to 1,238 privilege escalation candidates and 313 that leak memory information. Exploit agents, facing a kernel with its usual defenses switched on, produced 1,169 working root exploits and 291 working leak demonstrations. Several exploits often hit the same underlying flaw. After grouping variants, OpenAI wrote 948 distinct patches and treats that number as its count of unique vulnerabilities.
Exploitation took $775,929 of the total. A successful exploit averaged $359, while OpenAI’s 69 failed attempts averaged $3,922 each, so the dead ends are the costly part. Across the whole run, the bill works out to $1,279 per exploit.
OpenAI then priced its own work. The targets were an off-the-shelf desktop Linux, attacked under the ground rules of the Pwn2Own and TyphoonPWN hacking contests. Those contests have paid out $20,000 and, at the other end, $70,000 for a Linux kernel exploit of this type. Multiply by 948 and OpenAI arrives at a hypothetical valuation of $18.9 million to $66.3 million, roughly 16 to 55 times what the run cost. Nobody paid those sums. The valuation is OpenAI’s own arithmetic, and it shows the margin a criminal buyer or a bounty program would see.
Google’s kernelCTF, a contest around a hardened kernel with less attack surface, was the harder test. Over 112 hours and about $32,936, the pipeline produced 21 root exploits and 25 leak demonstrations. For scale, kernelCTF had accepted 26 confirmed zero-day exploits of this kind during 2026 when OpenAI wrote its post. OpenAI says the 21, if accepted, would earn a bounty of around $1.5 million.
Model quality did most of the work. In late July, GPT-5.6 Sol turned up and exploited 166 unique escalation bugs, for $513,690. The October model found 948, more than five times as many, even with three months of hardening between the two scans. Heavy scaffolding once mattered: 103 technique notes lifted GPT-5.5 Cyber from a 76.2% to an 88.9% success rate, yet moved GPT-5.6 Cyber by just 1.5 points, so OpenAI dropped them. An early run also showed 20 of 200 claimed exploits getting root through a different zero-day than the one assigned, which is why an independent check now sits in the pipeline. OpenAI held back technical details for safety.
On disclosure, ten days after the scan 61 of the bugs were patched upstream and 43 had patches waiting in staging. Another 299 were in the middle of being reported and discussed in public. OpenAI began with critical bugs on the advice of the Linux kernel community, and human researchers check everything before it reaches maintainers. The kernel runs past 40 million lines and this run touched about 7% of them, so the human review queue is the slow part of the system.
OpenAI’s own conclusion is blunt: a foothold as a limited user on a Linux box missing its patches “should be considered functionally equivalent to root access for a well-resourced threat actor.” Its advice includes sandboxes like Firecracker and gVisor, automated patching, and a fresh scan with every new model generation.
Anyone running untrusted code on shared Linux hosts, from build runners to multi-tenant servers, should plan as if a foothold equals root, and put sandboxing ahead of the next kernel update.
Reported by OpenAI on 4 November 2026.
