OpenAI pipeline validates 948 Linux kernel privilege-escalation flaws

OpenAI says an autonomous vulnerability-research pipeline generated 948 working local privilege-escalation exploits for the Linux kernel and produced candidate patches for the underlying flaws. The system’s mid-October 2026 run cost $1,213,430 in API credits, according to the company.

The pipeline examined 2,308 candidate findings and dynamically reproduced 1,724 of them in an isolated environment. It then generated 291 proof-of-concept demonstrations for information leaks and 1,169 working privilege-escalation exploits. After variant analysis, OpenAI counted 948 distinct local privilege-escalation vulnerabilities and developed patches for them.

The process had five stages: selecting security-relevant code, scanning for potential flaws, reproducing findings, testing whether they could enable information disclosure or privilege escalation, and generating patches. Human security researchers reviewed the exploits, proposed severity and patches before reporting findings to maintainers.

OpenAI says it sent hundreds of reports and patches for critical vulnerabilities, following guidance from the Linux kernel community. It is working with Patch the Planet partners to submit further reports and fixes. The company also noted that, during the 10 days of scanning and analysis, 61 local privilege-escalation flaws had been patched upstream, 43 had staging patches and 299 were being discussed publicly.

A separate run against an adapted kernelCTF environment produced 25 information-leak proofs of concept and 21 privilege-escalation exploits. That campaign cost about $32,936 in API credits. OpenAI said the 21 findings would correspond to roughly $1.5 million in potential bounty awards if accepted by the program; the company did not say that they had been accepted.

OpenAI describes the reported costs as an upper bound, saying further engineering could reduce expenses. It also stresses that the findings were generated in a controlled research setup and that human review and coordination with maintainers remain part of the process.

Sources: OpenAI News.