Overview
- OpenAI said its agent‑based pipeline ran in mid‑October 2026, narrowed the Linux kernel to about 5,034 audit targets, flagged 2,308 candidate bugs, reproduced 1,724 vulnerabilities and produced 948 distinct local privilege escalation exploits.
- The full evaluation cost $1,213,430 in API credits, which OpenAI reports as roughly $1,279 per distinct exploit when variant analysis reduced 1,169 working exploits to 948 unique flaws.
- OpenAI reported it has submitted hundreds of vulnerability reports and candidate patches to Linux maintainers, with 61 fixes merged upstream and 43 more in staging within about 10 days after the run.
- Researchers and outside experts said the agents used at least 10 exploitation techniques that appeared previously undocumented, and OpenAI stresses that human review is required because earlier runs misattributed some root causes.
- The finding lowers the cost and time to find kernel LPEs, which means defenders must update and harden systems faster while the same automated methods could be used by attackers if access to similar models spreads.