OpenAI's AI pipeline scans the Linux kernel and validates 948 bugs that let a local user gain root, with candidate patches
OpenAI's security team described a pipeline that automatically finds, reproduces, exploits and patches bugs. In mid-October it ran it, powered by an upcoming cyber model, on the latest Linux kernel. It flagged 2,308 candidate issues, reproduced 1,724 in isolated virtual machines, and confirmed 948 distinct bugs that let an unprivileged local user take full root control, each with a candidate patch. The run cost about $1.21 million in API credits, roughly $1,279 per bug. A July run with GPT-5.6 Sol found 166. Human researchers reviewed everything before reporting; on the Linux community's advice, OpenAI started with critical bugs and has sent hundreds of reports and patches. It says the agents used at least 10 attack techniques new to outside experts, and withheld details for safety.
Why it matters
Finding and exploiting kernel bugs is now cheap enough to do in bulk. OpenAI warns that on an unpatched system, a low-privileged account is effectively root, so maintainers and users need to patch faster.
Sources1
Written by dalao.ai: the title, summary and why it matters are our own words. The original reports are the record; their publishers keep authorship.