OpenAI’s pipeline drafted patches for 948 unique Linux LPEs

OpenAI says one mid-October 2026 run of an upcoming cyber model drafted candidate patches for 948 unique Linux local privilege-escalation vulnerabilities, at an API cost of $1,213,430—about $1,279 per unique LPE. Human researchers reviewed the outputs before reporting. When the 10-day scan and manual analysis finished, 61 of those LPEs were patched upstream, 43 had staging patches, and 299 were under public discussion.

That is the result in OpenAI’s November 4, 2026 write-up, “A thousand fewer paths to root.” It is a research-pipeline measurement, not a bounty-program launch. OpenAI’s post the same day matches the distinct-bug count: the run reproduced 1,724 vulnerabilities and produced proofs of concept for 291 information leaks and working exploits for 948 distinct local privilege-escalation vulnerabilities. Those exploits worked on a stock Linux desktop configuration with standard security protections.

What 948 counts

The 948 figure is the count after variant analysis, not the raw exploit tally. The pipeline identified 2,308 candidate kernel findings and dynamically reproduced 1,724. Later screening produced 1,169 working local privilege-escalation exploits—cases in which an unprivileged local user could gain root—plus 291 information-leak proofs of concept. Variant analysis reduced the privilege-escalation set to 948 distinct patches. OpenAI uses that patch count as the number of unique LPEs. Summaries that stop at 1,169 overstate how many distinct bugs the run claimed.

OpenAI chose the kernel because it underpins Android devices, cloud infrastructure, and supercomputers, and because more than 40 million lines of code make it a hard test of whether a model can find flaws and show their impact. The main target was a stock desktop operating system, not a weakened build, under a threat model OpenAI compares with competitions such as Pwn2Own and TyphoonPWN.

A separate pass on an adapted kernelCTF environment, a Linux kernel with a reduced attack surface, produced 21 LPE exploits and 25 information-leak proofs of concept at roughly $32,936 in API credits. OpenAI notes that kernelCTF had accepted 26 confirmed 0-day LPE exploits in 2026 at the time of writing. On the main run, applying historical Pwn2Own and TyphoonPWN amounts of $20,000 and $70,000 to the 948 exploits produces a hypothetical $18.9 million to $66.3 million. OpenAI presents that as a cost comparison, not as a program it is launching.

Where the $1.2 million went

Published stage costs show where the $1,213,430 went:

Scout agents selected 5,034 audit targets—about 2.8 million lines, roughly 7 percent of the kernel—for $3,426.
Analyst agents produced the 2,308 deduplicated candidates within 12 hours, for $316,549.
Validation reproduced 1,724 findings within 30 hours, about 74.7 percent of candidates, for $73,330. OpenAI says only 3.1 percent of the set reflected incorrect analysis; most of the rest needed elevated privileges or did not reproduce in the time budget.
Screening cost $44,194 and left 313 information-leak candidates and 1,238 LPE candidates.
The exploitation stage cost $775,929.

Successful exploits averaged about $359 in credits to develop, separate from the $1,279 end-to-end figure. OpenAI says these costs are closer to an upper bound: the run measured capability, not minimum spend, and further harness work could still cut each stage.

Humans still sit in front of upstream

The last stage is not automated. Security researchers review the report, the candidate patch, and the proposed severity before anything goes to maintainers. OpenAI says that check caught a real failure mode: in an early run, some results marked successful had reached root through a different vulnerability than the one assigned. The team added an independent check that each final exploit used its assigned bug.

Following Linux kernel community guidance, OpenAI says it started with critical vulnerabilities, has already sent hundreds of reports and patches, and is working with Patch the Planet partners to send the rest. The effort is part of the Daybreak commitment to open-source projects. It expands a June note, under the same Patch the Planet initiative, that GPT-5.5 Cyber had developed 24 local privilege-escalation exploits—not this October-scale run.

The backlog that was still open

Maintainers were already moving during the scan. After 10 days, 61 LPEs were patched upstream and 43 had staging patches, with 299 being reported and discussed publicly. OpenAI does not publish a full disposition for the remainder. Against 948 unique LPEs, an upstream patch on 61 is a small slice. The write-up’s triage advice is to revalidate findings against the latest tree, including code merged after the original scan, so maintainers are not handed duplicates or obsolete reports.

A July comparison is in the same document. A late-July run with GPT-5.6 Sol found and exploited 166 unique LPEs for $513,690 in API credits. The mid-October run, also against the then-latest kernel master branch, reached 948. OpenAI says the newer cyber model discovered more than five times as many novel LPEs despite three months of hardening between the scans.

OpenAI’s defensive claim is direct: for a well-resourced actor, a low-privileged account on an operating system that is behind on patches should be treated as functionally equivalent to root. Sandboxes and isolation, including approaches such as Firecracker and gVisor, are what the write-up points to for limiting blast radius.

Read the November 4 write-up for the funnel, the stage costs, and the 10-day upstream snapshot, and OpenAI’s post from that day for the 948 distinct-LPE and stock-desktop claims. If you ship or administer Linux, the useful watch is which of these reports actually land upstream.