Overview
OpenAI has published research showing an autonomous pipeline, driven by an unreleased cyber model, that discovered and exploited a large number of Linux kernel local privilege escalation (LPE) bugs. The scan ran in mid-October against the latest code in the kernel's master branch.
Results
| Metric | Figure |
|---|---|
| Potential bugs flagged | 2,308 |
| Bugs confirmed | 1,724 |
| Working LPE exploits | 1,169 |
| Information-leak proofs of concept | 291 |
| Distinct patches for the underlying bugs | 948 |
| API cost | About $1.21 million (roughly $1,279 per patch) |
The 948 figure counts the separate patches created for the bugs behind the exploits. OpenAI says the agents used at least 10 novel exploitation techniques, whose details are being withheld for safety reasons.
Method
AI agents first narrowed the kernel to security-relevant areas reachable by low-privileged users. Exploits were then tested on virtual machines running an unmodified desktop Linux configuration with KASLR, SMEP and SMAP enabled. Human security researchers validated exploits, proposed fixes and suggested severity before anything went to kernel maintainers.
Comparison and Scale
- An earlier late-July scan using GPT-5.6 Sol found 166 unique LPEs for about $514,000. The October run found more than five times as many new LPEs despite three months of kernel hardening in between.
- Using Pwn2Own and TyphoonPWN payout rates, OpenAI estimates the bugs would be worth $18.9 million to $66.3 million, 16 to 55 times the cost of the scan.
- An adapted version of Google's kernelCTF, a hardened target with less attack surface, yielded 21 LPE exploits over 112 hours for about $33,000 in API credits.
Disclosure Status
OpenAI has submitted hundreds of reports and patches. Within 10 days, more than 100 Linux LPEs had been patched or had staging patches, with about 300 more under public discussion. On November 2, OpenAI also raised its Security Bug Bounty payouts, with critical flaws in core products paying up to $30,000 and bonuses pushing a single payout to $172,000.
Why It Matters
OpenAI's conclusion is blunt: an unpatched, low-privileged account should be considered functionally equivalent to root access against a well-resourced attacker. Defenders should assume the cost of finding kernel LPEs is falling quickly.
Recommendations
- Patch kernels promptly and track distribution security advisories closely, as fixes land in bulk.
- Reduce the value of a low-privileged foothold: isolate untrusted workloads using sandboxing technologies such as Firecracker or gVisor, rather than relying on kernel privilege boundaries alone.
- Minimize local attack surface: disable unneeded kernel modules and unprivileged user namespaces where feasible.
- Prioritize initial-access defenses (patching exposed services, credential hygiene, MFA), since LPE is the second stage of most intrusions.