OpenAI Says Its Agents Built 948 Linux Root Exploits for $1.2 Million. The Model Is Gated, and Only 61 of the Bugs Were Patched Upstream When the Run Ended.
OpenAI's November 4 post describes an agent pipeline that scanned the Linux kernel's master branch in mid-October and, by OpenAI's count, produced 1,169 working local privilege-escalation exploits, deduplicated by patch to 948 unique bugs, against a stock desktop distribution with standard mitigations on, for $1,213,430 in API credits, or $1,279 per unique exploit. A July run with GPT-5.6 Sol found 166 for $513,690. Ten days after the run, 61 fixes had landed upstream, 43 were staged, and 299 were under public discussion. The model, named GPT-6 Cyber the next day, is available only to approved Daybreak Red customers, so nobody outside can reproduce the numbers. We read OpenAI's post.
By T.W. Ghost
OpenAI published "A thousand fewer paths to root" today, November 4, 2026. The claim: an agent pipeline, running what the post calls an upcoming cyber model, scanned the Linux kernel's master branch in mid-October and produced 948 unique local privilege-escalation exploits against a stock desktop distribution with SMEP, SMAP, KASLR, and hardened usercopy enabled, for $1,213,430 in API credits. That is $1,279 per root exploit. A July run of the same pipeline with GPT-5.6 Sol found 166 unique bugs for $513,690.
Every number in this post is OpenAI's, and the model that produced them is not available to anyone who would check. The day after this post, OpenAI named it GPT-6 Cyber and gated it behind the Daybreak Red program. Two more things to hold onto before the figures. First, 948 is a patch count, not an exploit count: the agents wrote 1,169 working exploits, and OpenAI deduplicated them by the kernel patch that fixes each one. Second, these are local exploits. An attacker needs an account or code execution on the machine first. We read OpenAI's post and the two companion posts on bounties and the next security sprint. Here is what held up.
The Pipeline, by OpenAI's Count
| Stage | Output | Cost |
|---|---|---|
| Scouts | 5,034 audit targets; about 2.8M lines; about 7% of the kernel | $3,426 |
| Analysts | 2,308 candidate findings in 12 hours | $316,549 |
| Reproduction | 1,724 reproduced (about 74.7%) in 30 hours; 3.1% judged incorrect analysis | $73,330 |
| Screening | 313 info-leak and 1,238 LPE candidates kept | $44,194 |
| Exploitation | 291 info-leak proofs of concept; 1,169 working LPE exploits; 948 distinct patches | $775,929; successes averaged about $359; 69 failures averaged $3,922 |
| Total | 948 unique LPEs | $1,213,430; $1,279 each; OpenAI calls the costs an upper bound |
| July baseline | 166 unique LPEs with GPT-5.6 Sol | $513,690 |
| Ten days later | 61 patched upstream; 43 staging patches; 299 under public discussion |
The cost curve is the story OpenAI wants told, and it is a real one on its own terms: more than five times the bugs for a little over twice the money, between July and October. It is also a price list. Whatever it costs a defender to find a root exploit with this pipeline is roughly what it costs an attacker with a comparable model.
Discovery outran patching by a wide margin. Sixty-one upstream fixes against 948 claimed bugs at the ten-day mark. OpenAI says hundreds of reports are out and the rest will go through its Patch the Planet effort under Daybreak, with no timeline attached. Until the fixes land as ordinary kernel updates, the bugs are known to OpenAI and whoever OpenAI told.
Nobody can reproduce this. The model is gated, the kernel targets were a mid-October snapshot, and the only numbers are the vendor's. That is the same posture as Anthropic's five exploit chains the week before: credible in the way a coordinated-disclosure list is credible, unverifiable in the way an unreleased model is.
The Rest of the Post
OpenAI adds a kernelCTF-style run of 21 LPEs and 25 info leaks in 112 hours for about $32,936, with the SLAB_VIRTUAL hardening dropped from the configuration, and notes 26 confirmed zero-day LPEs accepted by kernelCTF in 2026. It reports ten novel exploitation techniques in a sample of 166 exploits, which it cannot show. In an early run, 20 of 200 "successful" exploits reached root through a different zero-day than the one assigned, which is either a sign of abundance or a sign the grading was loose, and the post does not say which. It also found a QEMU TCG bug. A technique library helped the older GPT-5.5 Cyber a great deal, lifting success from 76.2% to 88.9% over 63 candidates, and helped GPT-5.6 Cyber by 1.5 points, which suggests the newer models need less scaffolding.
The bounty arithmetic, $18.9 million to $66.3 million of hypothetical payouts at Pwn2Own and TyphoonPWN rates, is marketing; no program pays for 948 exploits at once. Separately, OpenAI raised its own bug bounty on November 2, to $30,000 for critical findings and up to $100,000 for exceptional ones, $172,000 with bonuses, and announced a partnership with Cathedral for its next internal security sprint.
Verified vs Unconfirmed: The Scorecard
| Claim | Verdict |
|---|---|
| Published Nov 4; mid-October run on kernel master; stock desktop distro with standard mitigations | Vendor (OpenAI) |
| Stage counts and costs; 1,169 exploits; 948 distinct patches; $1,213,430; $1,279 each | Vendor (OpenAI) |
| July run: 166 LPEs for $513,690 | Vendor |
| 61 upstream patches, 43 staged, 299 in discussion at ten days | Vendor |
| Ten novel techniques; 20 of 200 reached root via a different bug | Vendor, unverifiable |
| Bounty-value framing | Vendor marketing |
| Model powering the run | GPT-6 Cyber, named Nov 5; Daybreak Red only |
| Independent reproduction | Not possible |
| A press description of the bugs as N-days | Conflicts with OpenAI's post; not repeated here |
What To Do
Patch kernels on a short cycle. OpenAI expects most of these fixes to arrive as ordinary updates, and the lag between a bug being known and being fixed is the window.
Treat shared Linux hosts and CI runners as the exposure, because local privilege escalation starts where untrusted code already runs.
The frontier is elsewhere: the model that did this is not for sale to you unless you are in Daybreak Red, and its price and system card arrived the next day. Our model comparison has the current standings side by side.
Sources
- OpenAI: a thousand fewer paths to root
- OpenAI: rewarding defenders with bigger bug bounties
- OpenAI: preparing our next security sprint to harden OpenAI
- OpenAI: introducing GPT-6 Cyber
- OpenAI deployment safety: GPT-6 Cyber
*Not sure what a $1,279 root exploit means for the Linux boxes you run? Take the free 2-minute quiz and get matched. Then read about the other lab's exploit disclosure and the three-tier gate in front of it: Anthropic's five exploit chains.*