OpenAI: an upcoming cyber model validated and patched 948 Linux kernel privilege-escalation bugs in one run for $1.2M in API costs
Confirmed
Importance: major (4 of 5)Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- Major (4 of 5)
- Last verified
- 5 November 2026
Your AI and this story
- GPT-6 Astra188 days after its cutoff
- Claude Opus 5.5127 days after its cutoff
- Gemini 4 Argon218 days after its cutoff
- Grok 4.7157 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 127 days before it.
Key facts
- 948 Linux kernel LPE vulnerabilities validated with generated patches in one run; total API cost $1.2M (OpenAI on X, 1.43M views)
- Greg Brockman: ‘almost 1,000 linux local privilege escalations … at the cost about $1,000 per vulnerability’ (X, 134k views)
- Eric Wallace (OpenAI): before AI, researchers found ~20 Linux LPEs in a typical year; the model found ~1,000 in a week with about $1M of tokens and ‘at least 10 novel classes of Linux exploitation techniques’; OpenAI is allocating ‘a significant amount of our frontier compute’ to pro bono open-source patching
- Press: The Hacker News described a 30-hour run; Phoronix, Help Net Security, Cybernews, CoinDesk and Gizmodo covered it
- The model is unreleased (‘upcoming cyber model’); OpenAI’s earlier cyber models (GPT-5.5-Cyber, GPT-5.6-Cyber) are gated through Daybreak
What happened
OpenAI published “A thousand fewer paths to root” (the page returned 403 to our fetcher; facts here come from OpenAI’s own X posts and press coverage). The pipeline finds kernel bugs, proves them exploitable and writes patches, all autonomously. Whether and how the patches are being upstreamed to kernel maintainers was not in the material we could read.
Why it matters
It is a large jump in the scale of AI vulnerability work: about fifty years of typical human Linux LPE discovery in a single run. The same capability is dual-use, which is why OpenAI keeps the model unreleased and frames the work as pro bono defence. It also follows the second-wave lesson that kernel maintainers and distributions must absorb a flood of AI-found bugs.
Sources
4 sources from 2 sites. Numbers match the chips in the text.
4 sources: 2 primary, 2 reactions
Primary
- OpenAI: A thousand fewer paths to rootopenai.com, official
- OpenAI on X (Nov 4)x.com, official
Reactions
- Eric Wallace on Xx.com, discussion
- Greg Brockman on Xx.com, discussion
Changes
- Filed