OpenAI has described a research prototype that used an upcoming cyber-focused AI model to find, reproduce and exploit Linux kernel flaws at scale. According to The Hacker News’s summary of OpenAI’s report, the pipeline analyzed 2,308 candidate kernel findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 local privilege escalation (LPE) exploits, meaning an unprivileged local user could gain root access. OpenAI says it also produced proof-of-concept code for 291 information-leak bugs. The run, in mid-October 2026 against “a commonly used Linux distribution” that the report excerpts do not name, cost $1,213,430 in API credits, or $1,279 per LPE exploit. OpenAI says the agents discovered and used at least 10 novel Linux exploitation techniques, including new ways to arrange kernel memory and five data-only methods for gaining privileges.
The pipeline has five stages: finding high-value targets and candidate bugs, reproducing each in a sandbox, assessing exploitability and building a proof of concept, generating a patch, and human review of the exploit, patch and proposed severity before anything goes to the maintainers. The Hacker News adds that the reproduction work took about 30 hours. It builds on 24 LPE exploits OpenAI said its GPT-5.5-Cyber model found in June 2026. OpenAI’s own conclusion, as quoted by THN: “having access to a low-privileged account on an operating system that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.” The report’s excerpts do not say how many of the 948 have been patched upstream.
Other published assessments point in the same direction. Google Threat Intelligence Group reports that vulnerabilities disclosed per month rose from 5,045 in January 2026 to 10,740 in August, and that high-risk disclosures grew from 131 to 350, a 167% increase. The UK’s National Cyber Security Centre says the widespread availability of AI-powered cyber tools “has almost certainly led to a significant increase in the discovery of zero-day vulnerabilities,” and that defensive AI tools have shortened the window between a zero-day and an n-day, though many systems remain exposed without correct configuration.
Sources
- OpenAI: A thousand fewer paths to root (returned 403 to automated fetching; figures here are attributed to The Hacker News’s summary)
- The Hacker News: OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run
- Google Threat Intelligence Group: Vulnerability Discovery and Exploitation Trends in the AI Era
- UK NCSC: Artificial intelligence and cyber intrusion