OpenAI’s automated kernel research pipeline found 948 working local privilege escalation exploits in a single mid-October 2026 run.
The company published details of the kernel research effort under its Patch the Planet initiative, part of a broader Daybreak open-source security commitment. The five-stage system runs on an upcoming cyber model. Its analyst agents flagged 2,308 deduplicated candidate findings on the latest Linux kernel master branch; each finished exploit lifts an unprivileged local user to root on a stock desktop distribution.
Nothing reached maintainers unsupervised. Human security researchers reviewed every exploit, patch, and severity rating before reporting. The work began with critical vulnerabilities under Linux kernel community guidance; hundreds of reports and patches have already gone upstream.
The pipeline scales a June disclosure in which GPT-5.5 Cyber identified kernel flaws and built 24 such exploits to validate and report them. The exploit targets weren’t weakened builds: the stock desktop distribution ran with SMEP and SMAP enabled alongside KASLR and HARDENED_USERCOPY, the same threat model used at Pwn2Own and TyphoonPWN.
Scout triage through exploit development
Scout agents read through each folder and file, flagging code reachable by low-privileged users. That triage compressed more than 40 million lines of kernel code into 5,034 audit targets. Analyst agents running a workflow modelled on OpenAI’s Codex Security plugin then scanned the filtered set, returning the full candidate list within half a day.
Triage agents wrote and fired proof-of-concepts inside isolated virtual machines running a kernel instrumented with Kernel Address Sanitizer, iterating until a crash reproduced or the trigger paths ran dry. The stage confirmed 1,724 real vulnerabilities.
A permissive screening agent then divided the validated set into information leak and privilege escalation classes. ExploitDev agents built working exploits from there before variant analysis consolidated the results into unique vulnerabilities, each with a distinct candidate patch.
Only 74.7 percent of the candidates survived dynamic validation. The failures clustered around privilege requirements, race conditions, and fault-injection dependencies rather than model error. Model error accounted for just 3.1 percent of the failures.
OpenAI audited its own success claims hard. An early run logged 200 successful exploits by the system’s count. Human reviewers went back through every one of them. They found 20 exploits had gained root through a different 0-day than the one assigned, so OpenAI tightened task constraints and added an independent check tying each final exploit to its assigned bug.
Exploit economics against bounty benchmarks
The full October campaign cost $1,213,430 in API credits, which works out to $1,279 for every working root exploit. Exploitation dominated the budget. OpenAI casts the reported costs as an upper bound. The company argues that harness engineering could cut spend at every stage.
The disclosure then values the same body of work against historical contest bounties. The Pwn2Own and TyphoonPWN rates for Linux kernel LPEs give the haul a hypothetical valuation of $66.3 million, roughly 16 to 55 times the campaign’s cost.
Google’s hardened kernelCTF environment provided a second proving ground. The pipeline produced 21 LPE exploits there in a single campaign, nearing the 26 confirmed 0-day LPEs accepted from human submitters across all of 2026. That’s one automated scan closing in on a year of human 0-day output.
The run even surfaced a QEMU TCG vulnerability in the testing harness itself, traced without any access to QEMU source. That bug was already fixed upstream, though the fix was missing from the release build under test.
GPT-5.6 Sol, an earlier OpenAI model, produced 166 such exploits in a late-July run. The kernel tree had absorbed months of additional hardening by the time October arrived. The new campaign still returned more than five times that count.
Novel techniques and upstream patching
The agents deployed at least 10 exploitation techniques that third-party kernel experts confirmed were new to them. Persistent elastic objects for cache spraying appear in the set. Page grooming for reliability does too. Data-only escalation paths and an arbitrary type confusion round out the list.
The heavy orchestration didn’t survive the model upgrades. A curated technique library lifted GPT-5.5 Cyber’s success rate from 76.2 to 88.9 percent, but GPT-5.6 Cyber beat both marks without it, so OpenAI stripped the scaffolding from the pipeline.
Maintainers moved in parallel as well: within 10 days of scanning and manual analysis, 61 of the found LPEs had been patched upstream. Staging patches covered dozens more. Public discussion was open on hundreds of the remainder.
“For the near- and medium-term, having access to a low-privileged account on an operating system that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor,” concludes OpenAI.
See also: Abu Dhabi oil giant ADNOC layers OpenAI’s agent platform over its own AI
Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including IoT Tech Expo and the Cyber Security & Cloud Expo. Click here for more information.
