948 exploits that take an unprivileged user to root on the Linux kernel, each with a candidate patch, in a single run, for $1,213,430 in API credits. That's the tally OpenAI published on November 4, 2026 in "A thousand fewer paths to root": an agent pipeline that audits the kernel, reproduces each bug, writes the exploit and proposes the fix before a human ever looks at it.
The problem, in numbers
The target was the latest kernel as of mid-October 2026, focusing on code a low-privileged user can reach. The funnel from that run shows how much noise has to be filtered out:
| Stage | Result |
|---|---|
| Candidate findings analysed | 2,308 |
| Vulnerabilities reproduced dynamically | 1,724 |
| Working information-leak proofs of concept | 291 |
| Working local privilege escalation (LPE) exploits | 948 |
That works out to roughly $1,279 per distinct bug. OpenAI calls the total an upper bound, since a better-tuned harness would spend less at each stage. The model behind it is a cyber model OpenAI has not released yet.
How the pipeline is built
The point isn't that a model "finds bugs". It's that every stage hands the next one evidence it can check:
- Discovery: agents analyse the parts of the kernel reachable without privileges and produce candidate findings.
- Dynamic validation: each finding becomes a proof of concept that runs in a virtual machine until the bug reproduces. Anything that doesn't reproduce is dropped.
- Exploitability: the strongest candidates go to agents that try to reach root on machines running a stock desktop operating system.
- Patching: a final stage writes a candidate patch and runs variant analysis, so one patch can close several exploits.
- Human review: researchers check the exploit, the patch and the proposed severity before anything goes to maintainers.
That's why 948 counts patches, not exploits. One of the authors explained on Hacker News that the raw exploit count is higher, but they grouped by the patch that closes them to avoid inflating the figure. They also made clear it's all kernel code; userspace software running as root was out of scope.
What has actually landed
This is the caveat that matters: 948 candidate patches are not 948 fixed bugs. Ten days after the scan, 61 privilege escalations had been fixed upstream, 43 had patches in staging and 299 were under discussion or publicly reported. Following the kernel community's advice, OpenAI started with the critical ones and is sending the rest gradually through Patch the Planet, the initiative it launched in June 2026 with Trail of Bits and HackerOne, among others. The exploits aren't being published, and neither are the ten exploitation techniques that, according to OpenAI, outside experts hadn't seen before.
Five months of growth
The most telling part is the progression with the same approach:
| Run | LPE | API cost |
|---|---|---|
| Patch the Planet launch (June 2026) | 24 PoCs | — |
| Late July 2026 scan | 166 | $513,690 |
| Mid-October 2026 scan | 948 | $1,213,430 |
| Google kernelCTF, hardened kernel (112 hours) | 21 | $32,936 |
Between July and October cost went up 2.4x and exploits 5.7x. The pipeline's author put it plainly on Hacker News: stronger models find many vulnerabilities weaker ones miss, and the plan is to rescan Linux with every new model generation. The kernelCTF row is the counterpoint: with a hardened kernel and less exposed surface, the haul drops to 21 exploits.
What we can learn
Audited code goes stale. A review, human or automated, is only as good as the tool that did it. If an October model finds almost six times more than a July one on the same code, "we already ran it through the analyser" stops being an argument.
Validation is what scales. The funnel from 2,308 to 948 works because every step demands something executable: a PoC that reproduces, an exploit that reaches root, a patch that closes it. It's the regression-test principle applied to security, and it's what lets maintainers receive evidence instead of alerts.
The bottleneck moves to patching. For anyone running Linux, the number that matters most is 61 out of 948. Expect months of a steady stream of local privilege escalation fixes in the kernel, and your exposure is set by how long it takes you to roll them out to your nodes. In multi-tenant clusters, where every container shares the kernel, an LPE is a container escape; that's where sandboxing or lightweight VMs and fast node rotation pay off more than ever.
Attack surface still matters. The gap between the general run and kernelCTF says that shrinking what an unprivileged user can touch keeps paying off.
What doesn't transfer
The model isn't available and the cost is out of reach for almost any team: $1.2 million for one pass over a single project. There's also no public data on bug categories or on the new techniques, so for now nobody can draw structural lessons about the kernel, something several Hacker News commenters asked for. What you can copy is the architecture: each agent hands verifiable evidence to the next stage, and a human makes the final call.
Sources
- A thousand fewer paths to root, OpenAI, November 4, 2026.
- A thousand fewer paths to root: report summary, AI/TLDR.
- OpenAI says its agents exploited and patched 948 Linux kernel flaws for $1.2M, Runtime Wire.
- OpenAI's AI pipeline turned 2,308 Linux kernel bugs into 948 root exploits, Startup Fortune.
- Hacker News discussion with the authors.