Security researchers have spent decades arguing about how fast machines could find and weaponize software bugs. On November 4, OpenAI put a price tag on the answer. In a single mid-October run, an autonomous pipeline built on an unreleased cyber model produced 948 distinct local privilege escalation vulnerabilities in the Linux kernel, each one a way for a low-privileged user to become root. The bill was $1,213,430 in API credits.
That works out to roughly $1,280 per vulnerability. For comparison, a single working Linux kernel root exploit can fetch tens of thousands of dollars at hacking contests. Here is what OpenAI actually did, what the numbers do and do not prove, and why defenders should pay attention.
The short version
- OpenAI’s pipeline flagged 2,308 suspected kernel bugs and confirmed 1,724 of them by reproducing the crash
- It produced 1,169 working root exploits, which collapsed into 948 distinct vulnerabilities after de-duplication
- Total API cost was about $1.2 million, or roughly $1,280 per vulnerability
- Human security engineers review every finding before it goes to a maintainer
- The model is unnamed and unreleased, and the tests ran on hardened lab setups, not live systems
What OpenAI built
According to OpenAI’s write-up, its security researchers assembled an autonomous system that handles the whole chain of work: finding a suspicious spot in the kernel, proving the bug is real, writing an exploit, and drafting a patch. Earlier AI bug-hunting tools mostly stopped at the “this looks wrong” stage. This one is built to finish the job.
The run started by narrowing the huge kernel codebase to areas that an unprivileged local user can actually reach. From there, AI agents analyzed candidate flaws, tried to trigger them in virtual machines, and attempted to turn each confirmed crash into root access. The test machines ran an unmodified desktop Linux setup with common protections switched on, including KASLR, SMEP and SMAP, the defenses that make kernel exploitation harder.
From 2,308 suspects to 948 real bugs
The funnel below shows how the pipeline whittled down its output. The drop from 1,169 exploits to 948 vulnerabilities matters: several exploits traced back to the same underlying flaw, so OpenAI grouped them and counted the flaw once.
The cost math
The most striking part is the price. OpenAI compared the $1.2 million bill with what the security market pays for this kind of work. Contests such as Pwn2Own and TyphoonPWN have paid roughly $20,000 to $70,000 for a Linux kernel privilege escalation exploit. At those rates, 948 bugs would be worth somewhere between about $19 million and $66 million, which is 16 to 55 times what the run cost.
| Measure | Figure | What it means |
|---|---|---|
| Total API cost | $1,213,430 | One run, one unreleased model |
| Cost per vulnerability | About $1,280 | Total cost divided by 948 |
| Typical contest payout | $20,000 to $70,000 | Per Linux kernel root exploit |
| Implied market value | $19M to $66M | 16 to 55 times the run cost |
One outlet also reports that an earlier OpenAI model, GPT-5.6 Sol, found 166 unique root flaws for about $513,690 in late July. That would put the earlier cost near $3,100 per bug, so the new run is cheaper by more than half per vulnerability. Treat that comparison as indicative, since it comes from a single report.
The caveats that matter
It would be easy to read this as “AI can now root any Linux machine for pocket change.” That is not what was shown. Several limits apply:
- Local, not remote. These are local privilege escalation bugs. An attacker needs a foothold on the machine first. The flaws turn a small break-in into a total one, but they do not open the front door.
- Lab conditions. Part of the testing used an adapted version of Google’s kernelCTF, a hardened kernel with a reduced attack surface. On that environment the pipeline reportedly produced 25 information leak proofs of concept and 21 privilege escalation exploits.
- One configuration. The main run used a single unmodified desktop distribution. Other kernels, builds and cloud images may behave differently.
- Counting rules. The 948 figure counts vulnerabilities, not merged fixes. The patches the pipeline generates are candidates that maintainers still have to review.
- No model name. OpenAI only calls it “an upcoming cyber model,” so nobody outside the company can reproduce the results yet.
How OpenAI says it is handling disclosure
Dumping nearly a thousand root bugs on volunteer maintainers would be its own kind of attack, so the rollout matters. OpenAI says human security engineers review exploits, patches and severity before anything is sent. It started with the most severe cases, following advice from the kernel community, and has already sent hundreds of reports with patches attached. The rest are meant to go out gradually with partners in a program it calls Patch the Planet.
Coverage of the announcement says maintainers had already patched 61 of the flaws by the time OpenAI finished its analysis, with another 43 sitting in staging. Exact counts differ slightly between outlets, so check OpenAI’s own post for the latest numbers.
What to do if you run Linux systems
- Apply kernel updates promptly over the coming weeks, since a wave of patches is on the way
- Limit who can run code locally on shared servers, because these bugs need a foothold first
- Keep containers and CI runners on current kernels, as they often share a host kernel
- Turn on automatic security updates where your distribution supports them
Why this changes the defender’s math
The same capability cuts both ways. If a company can fund a seven-figure run to find and fix bugs, so can a well-resourced attacker who wants to hoard them. That is the uncomfortable core of the news: the economics of vulnerability discovery are shifting from scarce human expertise to purchasable compute.
Others have been warning about this for months. Bill Gates argued that the coming year belongs to hackers rather than rogue robots, which we covered in Bill Gates says the next year of AI belongs to hackers. Google has also been building a defender-focused tier, as described in our look at Gemini 4 Argon and its cyber defender version. And the labs themselves are tightening the leash on their agents, as seen when Anthropic cut internet access from AI agent tests after real world exploits.
The hopeful reading is that patching can scale too. A pipeline that writes the exploit also drafts the fix, and if maintainers can absorb that flow, the Linux kernel could end the year with a thousand fewer paths to root. The cautious reading is that review capacity, not discovery, is now the bottleneck, and that every lab will soon have a pipeline like this one.
What to watch next
Three things will tell us how this plays out: whether OpenAI names and releases the model, how quickly distributions ship the fixes, and whether other labs publish comparable numbers. If the cost per bug keeps falling, expect kernel maintainers and distribution security teams to ask for more automated triage of their own.
Sources and further reading
- OpenAI: A thousand fewer paths to root
- TechRadar: OpenAI says its cyber model found and patched nearly 1000 Linux kernel security issues
- Phoronix: OpenAI finds 948 local privilege escalation bugs in the Linux kernel
- SecurityWeek: AI agents got root on Linux via 948 kernel flaws in OpenAI research
- AI Weekly: OpenAI mints 948 Linux root exploits in $1.2M pipeline run
Featured image: server room, free stock photo via Pexels.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
