{"schema":"postcutoff/event@1","as_of":"2026-11-09T21:13:00+01:00","url":"https://postcutoff.com/e/2026-11-04-openai-cyber-pipeline-948-linux-privilege-escalations/","md":"https://postcutoff.com/e/2026-11-04-openai-cyber-pipeline-948-linux-privilege-escalations/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-11-04-openai-cyber-pipeline-948-linux-privilege-escalations","date":"2026-11-04","date_precision":"day","short_title":"OpenAI: an upcoming cyber model validated and patched 948 Linux kernel privilege-escalation bugs in one run for $1.2M in API costs","deck":null,"takeaway":null,"category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"OpenAI: A thousand fewer paths to root","url":"https://openai.com/index/a-thousand-fewer-paths-to-root","type":"official","group":"primary","domain":"openai.com"},{"n":2,"title":"OpenAI on X (Nov 4)","url":"https://x.com/OpenAI/status/2118119451401048497","type":"official","group":"primary","domain":"x.com"},{"n":3,"title":"Eric Wallace on X","url":"https://x.com/Eric_Wallace_/status/2118123944251453949","type":"discussion","group":"reactions","domain":"x.com"},{"n":4,"title":"Greg Brockman on X","url":"https://x.com/gdb/status/2118129547443056763","type":"discussion","group":"reactions","domain":"x.com"}],"official":2,"filed":"2026-11-05","updated":"2026-11-05","orgs":["OpenAI"],"title":"OpenAI: an upcoming cyber model validated and patched 948 Linux kernel privilege-escalation bugs in one run for $1.2M in API costs","summary":"On Nov 4, 2026 OpenAI said its security researchers built an autonomous vulnerability discovery, exploitation and patching pipeline; in a single run with an upcoming cyber model it validated and generated patches for 948 local privilege escalation (LPE) vulnerabilities in the Linux kernel at a total API cost of $1.2M (about $1,000 per bug). OpenAI researcher Eric Wallace contrasted this with ~20 Linux LPEs found by humans in a typical year.","key_facts":["948 Linux kernel LPE vulnerabilities validated with generated patches in one run; total API cost $1.2M (OpenAI on X, 1.43M views)","Greg Brockman: 'almost 1,000 linux local privilege escalations … at the cost about $1,000 per vulnerability' (X, 134k views)","Eric Wallace (OpenAI): before AI, researchers found ~20 Linux LPEs in a typical year; the model found ~1,000 in a week with about $1M of tokens and 'at least 10 novel classes of Linux exploitation techniques'; OpenAI is allocating 'a significant amount of our frontier compute' to pro bono open-source patching","Press: The Hacker News described a 30-hour run; Phoronix, Help Net Security, Cybernews, CoinDesk and Gizmodo covered it","The model is unreleased ('upcoming cyber model'); OpenAI's earlier cyber models (GPT-5.5-Cyber, GPT-5.6-Cyber) are gated through Daybreak"],"key_numbers":[],"tags":["cybersecurity","linux","vulnerabilities","agents","openai","defense"],"science":null,"body_md":"## What happened\n\nOpenAI published \"A thousand fewer paths to root\" (the page returned 403 to our fetcher; facts here come from OpenAI's own X posts and press coverage). The pipeline finds kernel bugs, proves them exploitable and writes patches, all autonomously. Whether and how the patches are being upstreamed to kernel maintainers was not in the material we could read.\n\n## Why it matters\n\nIt is a large jump in the scale of AI vulnerability work: about fifty years of typical human Linux LPE discovery in a single run. The same capability is dual-use, which is why OpenAI keeps the model unreleased and frames the work as pro bono defence. It also follows the second-wave lesson that kernel maintainers and distributions must absorb a flood of AI-found bugs.","disputed":[],"related":[{"id":"2026-11-03-openai-security-sprint-cathedral-bug-bounty-172k","url":"https://postcutoff.com/e/2026-11-03-openai-security-sprint-cathedral-bug-bounty-172k/","date":"2026-11-03","date_precision":"day","short_title":"OpenAI brings in Cathedral for its next internal security sprint and more than quadruples critical bug-bounty rewards (up to $172,000)","deck":null,"takeaway":"Cathedral is the ex-DOGE startup that said in October its agents got into Anthropic's business systems.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":3,"official":3,"filed":"2026-11-03","updated":"2026-11-03","orgs":["OpenAI","Cathedral Systems"]},{"id":"2026-10-21-php2shell-ai-found-php-rce","url":"https://postcutoff.com/e/2026-10-21-php2shell-ai-found-php-rce/","date":"2026-10-21","date_precision":"day","short_title":"PHP2Shell: critical remote-code-execution flaws in PHP, found with GPT-5.6 Sol and Gemini 4 Argon, force emergency patching and take websites offline worldwide","deck":null,"takeaway":"The bugs were found with frontier AI: by Calif with GPT-5.6 Sol under OpenAI's Patch the Planet programme, and by Google's Wiz with Gemini 4 Argon, GPT-5.6 Sol and its Wiz Atlas agent.","category":"policy-safety","category_label":"Policy & safety","importance":5,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":13,"official":10,"filed":"2026-10-22","updated":"2026-10-25","orgs":["OpenAI","Wiz","Google","PHP"]},{"id":"2026-09-03-openai-daybreak-frontline-defenders","url":"https://postcutoff.com/e/2026-09-03-openai-daybreak-frontline-defenders/","date":"2026-09-03","date_precision":"day","short_title":"OpenAI commits $1B in subsidized Daybreak cyber-AI access for under-resourced 'frontline defenders'","deck":null,"takeaway":"As labs release models that can find and exploit zero-days, they are also paying to put those capabilities in defenders' hands first.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":8,"official":6,"filed":"2026-09-30","updated":"2026-10-02","orgs":["OpenAI"]}],"people":[{"id":"greg-brockman","name":"Greg Brockman","url":"https://postcutoff.com/person/greg-brockman/"}],"posts":[{"id":"x-eric_wallace_-2118123944251453949","title":"“We are now allocating a significant amount of our frontier compute towards discovering…”","url":"https://postcutoff.com/p/x-eric_wallace_-2118123944251453949/"},{"id":"x-gdb-2118129547443056763","title":"“we've found, validated, and prepared patches for almost 1,000 linux local privilege…”","url":"https://postcutoff.com/p/x-gdb-2118129547443056763/"},{"id":"x-openai-2118119451401048497","title":"OpenAI: upcoming cyber model validated and patched 948 Linux LPE bugs for $1.2M","url":"https://postcutoff.com/p/x-openai-2118119451401048497/"}],"videos":[],"models":[],"changes":[{"date":"2026-11-05","type":"filed","text":"Created"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-11-05","run":null,"sources_read":null,"updated":"2026-11-05","human_review":null,"version":{"date":"2026-11-05"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":188,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":127,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":218,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":157,"in_training_data":false}],"short_url":"https://postcutoff.com/s/openai-upcoming-cyber-validated"}