Overview
- OpenAI disclosed on November 4, 2026 that a mid‑October evaluation run of an autonomous multi‑agent pipeline examined about 2.8 million security‑relevant lines of Linux code, flagged 2,308 candidates, reproduced 1,724 issues and produced 948 distinct working local privilege escalation exploits.
- The full run used roughly $1,213,430 in API credits, which OpenAI reported as an average cost of about $1,279 per exploit and included role breakdowns such as scout, analyst and triage agents.
- The exploits worked on stock desktop Linux with common mitigations like SMEP, SMAP and KASLR enabled, but they require a low‑privileged local account rather than remote access.
- As of the announcement 61 vulnerabilities were fixed upstream and 43 had staged patches, leaving the majority of findings waiting for maintainer review and human triage.
- The result marks a sharp rise from OpenAI’s June disclosure of 24 LPEs and signals a possible shift in exploit economics that could make kernel LPEs cheaper to produce while increasing pressure on maintainers and defenders to speed review and patching.