OpenAI Pipeline Produced 948 Linux Kernel Privilege-Escalation Exploits From a Scan of About 7% of the Kernel

OpenAI published a description on November 4 of a prototype agent pipeline that audited the Linux kernel, reproduced bugs, wrote exploits and drafted patches. In a mid-October run, the system flagged 2,308 candidate findings and dynamically reproduced 1,724 vulnerabilities. It produced working exploits for 948 distinct local privilege escalation (LPE) bugs. One report says the exploit stage generated 1,169 working exploits before variant analysis consolidated them into 948 unique flaws.

The scope was narrow compared with the result. According to The Hacker News and Unite.ai, scout agents chose 5,034 audit targets covering about 2.8 million lines, roughly 7% of the kernel. Coverage puts the API spend at about $1.2 million. OpenAI says the agents discovered and used at least 10 novel Linux exploitation techniques and that it is withholding the details for safety reasons. Phoronix and others report that upstream maintainers have addressed 61 of the bugs so far and have staging patches for 43 more.

Two limits apply. An LPE requires an existing foothold on the machine, so none of these bugs gives remote compromise on its own. The figures also come from OpenAI's own write-up. Kernel maintainers have confirmed only part of the set through the patches they have merged. Even so, the run is a stronger result than a benchmark score. The exploits ran against real code, and they were reproduced dynamically rather than graded by a model.

Other frontier labs measure the same capability. Anthropic maintains a Frontier Red Team that studies cyber and other national-security-relevant capabilities in its models. OpenAI's post is the first lab disclosure in this cycle to put a cost per exploitable bug on that work.