One AI scanned 2,308 flaws. It broke into root 948 times.
OpenAI ran an autonomous security pipeline, powered by an unreleased cyber model, against the Linux kernel in mid-October 2026. Out of 2,308 candidate findings, it reproduced 1,724 real vulnerabilities, built working local privilege-escalation exploits for 948 of them, and drafted a patch for every single one. The whole run cost $1,213,430 in API credits — about $1,279 per exploit. For comparison, a July run with GPT-5.6 Sol found 166 exploits for $513,690.
The kernel matters because it underpins Android phones, cloud servers, and supercomputers — billions of devices run on it. The pipeline worked in five stages: scout agents picked audit targets, analyst agents scanned the code, triage agents reproduced each flaw in an isolated virtual machine, exploit agents tested whether each flaw could hand an unprivileged user root access, and the system drafted patches for human researchers to review before reporting them to maintainers.
The good news for defenders: Linux maintainers are moving fast. By the time the scan finished, 61 of the exploits were already patched upstream, 43 had staging patches, and 299 were being reported and discussed publicly. The model also found 10 exploitation techniques that kernel experts say are new — though OpenAI withheld the technical details for safety.
The caveats: these are OpenAI’s own figures, the model is unreleased, and the patches are drafts for maintainer review — not shipped fixes yet.
The storyline
Hook: One AI scanned 2,308 flaws. It broke into root 948 times.
Context: OpenAI’s pipeline scanned the Linux kernel and reproduced 1,724 flaws. Your phone runs on this kernel.
Stakes: It built a working root exploit for 948 of them. Each exploit cost about $1,279 in API credits. It also drafted a patch for every single one. Sixty-one flaws were already fixed upstream.
Payoff: AI now finds the holes and writes the fixes. Keep your systems updated — and send this to one person who runs Linux.
Watch next
Voters rejected data-center projects in 40 of 41 ballots across the U.S. — the backlash against AI infrastructure, and what it means for the buildout.
How we verified this
Figures come from OpenAI’s own post, “A thousand fewer paths to root” (Nov 4, 2026), cross-checked against its cost breakdown: $1,213,430 total for 948 exploits works out to about $1,279 each, and the July comparison run (166 exploits, $513,690) is stated in the same post. The caveats above — unreleased model, drafted patches, withheld technique details — are all stated in the source.
Links
- Watch the reel: https://www.instagram.com/p/DfXT_nWA7q_/
- Source: OpenAI, “A thousand fewer paths to root” — https://openai.com/index/a-thousand-fewer-paths-to-root/
- https://www.instagram.com/simpleaiexplains/
- https://buymeacoffee.com/simpleaiexplains
Leave a Reply