- OpenAI's automated system identified 948 Linux kernel vulnerabilities and discovered 10 new exploitation techniques.
- The system analyzed thousands of security issues, generating effective exploits and candidate patches.
- The entire process cost $1.21 million, highlighting the model's importance in vulnerability identification.
- The research indicates that automated patch generation will become increasingly important as model capabilities improve.
OpenAI has developed an automated cybersecurity research process that successfully identified 948 different Linux kernel vulnerabilities, which could allow local users to gain root access, and discovered at least 10 previously unrecorded exploitation techniques. The system analyzed thousands of potential security issues, reproduced vulnerabilities in a controlled environment, and generated effective exploits and candidate patches for human review. OpenAI stated in a research paper that the process identified 2,308 candidate findings and dynamically reproduced 1,724 of them.
Subsequently, 1,169 valid local privilege escalation (LPE) exploits were generated, narrowed down to 948 different vulnerabilities through variant analysis. Activities in mid-October 2026 utilized an upcoming network model that the company has not publicly disclosed. The entire process cost $1.21 million in API tokens, averaging about $1,279 per LPE vulnerability (approximately HK$9,976). This research highlights how increasingly powerful models can assist security teams in identifying and fixing critical software flaws before attackers can exploit them.
Five Stages of the Automated Process
OpenAI's system follows a five-stage process that encompasses vulnerability discovery, dynamic verification, exploitability assessment, patch generation, and human review. First, the exploration agent identifies security-related Linux kernel components, narrowing the audit scope to 5,034 targets, covering approximately 2.8 million lines of code, about 7% of the codebase. Our security researchers established an autonomous process for discovering, exploiting, and patching network vulnerabilities. In a single run, the process validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel.
The analysis agent subsequently examined these targets and produced 2,308 candidate findings within 12 hours. The system attempted to reproduce each issue in an isolated virtual machine, confirming 1,724 vulnerabilities, and completed this in 30 hours.
The exploit development agent tested whether these verified flaws could expose information or achieve local privilege escalation. The system generated 291 proof-of-concept information leaks and 1,169 valid LPE exploits. Variant analysis identified 948 different vulnerabilities. The process also generated candidate patches, which were reviewed by human security researchers before being reported to maintainers. OpenAI stated that hundreds of reports and patches for critical vulnerabilities have been sent based on guidance from the Linux kernel community.
The company collaborated with Patch the Planet partners to report and address other issues.
Discovery of New Exploitation Techniques
Researchers sampled 166 exploits and found that the agent employed at least 10 previously unrecorded exploitation techniques. Third-party kernel exploitation experts consulted by the team also deemed these techniques to be new. These include methods for placing objects in kernel memory caches, enhancing the reliability of exploits, and achieving privilege escalation through data-only attacks. The updated process also showed significant growth compared to earlier activities. In July 2026, GPT-5.6 Sol discovered and exploited 166 unique LPE vulnerabilities at a cost of $513,690 (approximately HK$4,006,782).
The October run identified 948, more than five times the previous number, despite additional kernel hardening conducted within three months.
OpenAI compared the 948 vulnerabilities with historical Linux kernel vulnerability bounties from Pwn2Own and TyphoonPWN. Based on past reward calculations, the estimated value of these vulnerabilities ranges from $18.9 million to $66.3 million, or 16 to 55 times the pipeline cost. This is a demonstrative comparison rather than actual bounty income. The company stated that its goal is to help defenders identify and fix vulnerabilities before attackers can exploit them. It also emphasized that as model capabilities improve, automated patch generation and repeated security reviews will become increasingly important.
These findings were released by OpenAI as part of its Patch the Planet initiative.
Item Specification Number of Vulnerabilities Identified 948 Number of Candidate Findings 2,308 Number of Vulnerabilities Reproduced 1,724 Number of Valid LPE Exploits 1,169 Total Cost $1.21 million (approximately HK$9,434,000)
Impact of the Automated System on Cybersecurity
OpenAI's automated cybersecurity system demonstrates its potential in vulnerability identification and patching. As technology advances, such systems can quickly discover and remediate critical vulnerabilities, thereby reducing the risk of exploitation by attackers. This not only enhances the efficiency of security teams but also provides a new defense strategy for the entire industry, especially in the face of increasingly complex cyber threats. The ability to automate patch generation will become an essential component of future cybersecurity defenses, helping organizations proactively mitigate risks before attackers can act.