OpenAI Says Its Cyber Pipeline Validated and Wrote Patches for 948 Linux Local Privilege Escalations at $1.2 Million in API Cost; Bounty Multiples Are Hypothetical and All Figures Are Self-Reported

On November 4, 2026, OpenAI published a research post called "A thousand fewer paths to root". It describes an autonomous pipeline that finds, validates, exploits and patches vulnerabilities in the Linux kernel, built around a cyber model that the post calls upcoming. The headline claim is that one run validated and generated patches for 948 local privilege escalation (LPE) vulnerabilities at an API cost of $1.2 million. These are OpenAI's own figures. The post names no individual vulnerability, and it withholds the full details of the new exploitation techniques for safety reasons.

The numbers come from a funnel, and each stage counts something different. Scout agents chose 5,034 audit targets, about 2.8 million lines or roughly 7% of a kernel of more than 40 million lines, for $3,426. Analyst agents produced 2,308 candidate findings after deduplication in 12 hours for $316,549. In virtual machines running KASAN, triage agents reproduced 1,724 of them, about 74.7%, within 30 hours, and the post says only 3.1% rested on an impossible condition. A screening agent narrowed the validated set to 313 information-leak and 1,238 LPE candidates. Exploit agents then produced 291 leak proofs of concept and 1,169 working LPE exploits. After variant analysis the team wrote 948 distinct patches and uses that number as the count of unique LPEs. So 1,169 counts exploits, while 948 counts distinct underlying bugs.

Cost figures follow the same stages. The exploitation stage cost $775,929: $691,000 for LPE candidates and $84,929 for leak candidates. A successful exploit averaged about $359, but the 69 failed attempts averaged $3,922 each, because a few hard cases such as race conditions used up budget. The post suggests a give-up rule, for example stopping after an hour without progress. The end-to-end cost of the October run was $1,213,430, and the authors call their costs an upper bound because the work measured capability, not cost. While the pipeline was still under development, GPT-5.6 Sol found and exploited 166 unique LPEs in late July for $513,690 on the then-latest kernel. The two runs differ in model and in kernel snapshot, so they are not a controlled comparison.

The post also compares cost with bounties. Applying historical Pwn2Own ($20,000) and TyphoonPWN ($70,000) Linux LPE rewards to 948 exploits gives a hypothetical $18.9 million to $66.3 million, 16 to 55 times the pipeline cost. In Google's kernelCTF environment, the team used the latest Linux kernel and removed the incompatible SLAB_VIRTUAL mitigation from the configuration; under that modified setup, a 112-hour campaign costing about $32,936 produced 25 information-leak proofs of concept and 21 LPE exploits. The post says that would be worth about $1.5 million if accepted, around 45 times the cost, and notes that 26 confirmed zero-day LPEs had been accepted by the program in 2026 at the time of writing. These are hypothetical valuations from public payout amounts, not money earned, and they assume every exploit is accepted. The post counts API cost only.

On patching speed, the scan ran on the latest kernel in mid-October. When the autonomous scan and manual analysis finished after 10 days, 61 LPEs were already patched upstream, 43 had staging patches, and 299 were being reported and discussed publicly. OpenAI says it has sent hundreds of reports and patches for critical bugs at the kernel community's suggestion, and is working with Patch the Planet partners to send the rest. Patch the Planet, announced on June 22 as a Daybreak initiative with Trail of Bits, states on its page that security engineers review findings before they reach maintainers. The kernel pipeline likewise ends with human researchers reviewing the exploit, patch and severity before reporting.

The post also shares lessons about verifying agents. In an early run the exploitation stage reported 200 successful LPEs, but human review found that 20 had reached root through a different zero-day than the one assigned, so OpenAI added an independent check that each exploit used its assigned bug. On orchestration, supplying 103 exploitation techniques to GPT-5.5 Cyber raised success on 63 candidates from 76.2% to 88.9%. With GPT-5.6 Cyber, a lightly orchestrated workflow without that layer beat the heavier GPT-5.5 workflow, and adding the layer back gave only 1.5 points. In a sample of 166 exploits the agents used 10 techniques that the authors and outside kernel experts judged new. Patch generation needed iteration, because first patches stopped the proof of concept but sometimes added extra code, ignored conventions or missed variants. The kernelCTF run also found a QEMU TCG bug that upstream had fixed but the release build in use had not.

Reading the post means keeping its limits in view. It is a vendor report with no independent replication, no public list of vulnerabilities and no estimate of missed bugs, and its costs cover API spend, not the time of the people who reviewed the work. The $1.2 million is one API bill for one configuration, not a price for auditing any kernel, and the bounty multiples are not profit. The authors' own advice is to rescan audited code as models improve, to recheck whether heavy orchestration is still worth maintaining, and to verify the path to a result as well as the result.