OpenAI’s autonomous cyber pipeline uncovers and patches 948 Linux kernel root flaws

OpenAI detailed an autonomous vulnerability research and patching pipeline that audited 5,034 security-sensitive targets (2.8 million lines of code) inside the 40-million-line Linux kernel in mid-October 2026. Driven by an upcoming OpenAI cyber model, the five-stage workflow chains static code scouting, root-cause analysis, dynamic reproduction inside Kernel Address Sanitizer (KASAN) virtual machines, exploit construction under modern kernel mitigations (SMEP, SMAP, KASLR and HARDENED_USERCOPY) and automated candidate patch synthesis ahead of human researcher review.

Across 12 hours of discovery ($316,549 in API credits) and 30 hours of dynamic VM validation ($73,330), the system triaged 2,308 deduplicated bug reports and dynamically triggered 1,724 real bugs (74.7%), with a 3.1% false-analysis rate. Exploit-development agents then produced 291 kernel information-leak proofs of concept and 1,169 working local privilege-escalation (LPE) root exploits, resolving to 948 distinct Linux kernel LPE vulnerabilities alongside candidate patches.

Total compute across all stages cost $1,213,430 in API credits, or $1,279 per distinct LPE vulnerability ($359 average compute per working exploit), finding 5.7 times more unique LPEs than an earlier late-July 2026 run with GPT-5.6 Sol (166 unique LPEs for $513,690). Manual inspection of 166 sampled exploits identified 10 previously undocumented kernel exploitation techniques, while a separate 112-hour run against Google’s hardened kernelCTF target produced 21 LPE exploits and an unpatched QEMU TCG escape for $32,936. OpenAI is coordinating disclosure and patch upstreaming with Linux kernel maintainers and has not named or scheduled the underlying cyber model for public release.