A new report from OpenAI has pulled back the curtain on the immense power of AI in cybersecurity. An automated system using an advanced AI model identified and created working exploits for nearly 1,000 security flaws in the Linux kernel.
A Troubling Discovery in a Vital System
The Linux kernel
is one of the most important pieces of software on the planet, underpinning everything from cloud servers and supercomputers to billions of Android phones. In a research run conducted in mid-October 2026, OpenAI deployed an automated pipeline powered by a new, unnamed 'cyber model'. This system didn't just find theoretical weaknesses; it proved they were real by building 948 unique, working exploits. This achievement highlights a massive leap in the capability of AI to not only discover but also weaponize software vulnerabilities at an unprecedented scale.
What is Local Privilege Escalation?
The 948 exploits all fall into a critical category known as Local Privilege Escalation, or LPE. In simple terms, an LPE attack allows someone who already has basic, limited access to a computer system to gain full administrative control. Think of it like having a key to a single office in a skyscraper and using a flaw in the building's security to get the master key that unlocks every single door, including the server room and executive suites. Once an attacker achieves this 'root' access on a Linux machine, they can effectively do anything: steal or delete data, install malware, or create new user accounts for future access. It's a foundational step in many serious cyberattacks.
An AI Pipeline for Finding Flaws
OpenAI's process was methodical and multi-staged. First, 'Scout' agents scanned the Linux kernel's 40 million lines of code to identify security-relevant areas accessible to low-privilege users. Then, 'Analyst' agents flagged potential bugs, generating over 2,300 candidates. A 'Triage' agent then worked to reproduce these bugs in a safe, sandboxed environment, confirming 1,724 of them were real. Finally, 'ExploitDev' agents were tasked with creating proof-of-concept exploits to demonstrate that these bugs could be used to gain control, ultimately resulting in the 948 unique LPE exploits. This entire automated process cost approximately $1.2 million in API credits, or about $1,279 per successful exploit.
The Economics of AI-Powered Hacking
While $1.2 million may sound expensive, OpenAI puts the figure into a startling context. Historically, bug bounty programs like Pwn2Own have paid between $20,000 and $70,000 for a single Linux kernel LPE exploit. At those rates, the 948 exploits discovered by the AI could have a hypothetical value between $18.9 million and $66.3 million, representing a potential return on investment of 16 to 55 times the cost of the scan. This demonstrates a seismic shift in the economics of vulnerability discovery. What once required elite human expertise can now be automated at a fraction of the cost, a reality that holds true for both defenders and malicious actors. Remarkably, the AI agents also developed at least 10 novel exploitation techniques that were previously unknown to human experts.
A Race Between Discovery and Defense
OpenAI's research is not about creating tools for attackers. The company followed a process of responsible disclosure, reviewing the findings with human experts before reporting them to the Linux kernel maintainers. They have already submitted hundreds of reports and patches for the most critical flaws. Within 10 days of the scan, over 100 of the vulnerabilities were either patched or had fixes in progress, with hundreds more under public discussion. This research underscores a new reality: the window to fix known vulnerabilities is shrinking. OpenAI advises that for any system not fully up-to-date with security patches, a low privilege account should be considered 'functionally equivalent to root access' for a well resourced attacker.
