OpenAI has demonstrated the growing capabilities of artificial intelligence in cybersecurity after an automated research system identified 948 working local privilege escalation exploits in the Linux kernel during a single campaign.
The findings emerged from a mid-October research run conducted under the company’s Patch the Planet initiative, part of its broader Daybreak commitment to open-source security. The five-stage pipeline, powered by an upcoming cybersecurity model, identified 2,308 distinct candidate vulnerabilities across the latest Linux kernel master branch.
Each of the 948 confirmed exploits demonstrated the ability to elevate an unprivileged local user account to root access on a standard desktop Linux distribution.
OpenAI emphasized that human security researchers remained involved throughout the process. Every exploit, proposed patch and severity assessment underwent manual review before being reported to maintainers. The research initially prioritized critical vulnerabilities in accordance with Linux kernel community guidance, with hundreds of reports and patches subsequently submitted upstream.
Five-Stage AI Pipeline Identifies Vulnerabilities
The research pipeline was designed to automate much of the vulnerability discovery and exploitation process across the Linux kernel’s extensive codebase.
Scout agents initially examined more than 40 million lines of kernel code, identifying components that could be accessed by users with limited privileges. This process reduced the investigation to 5,034 audit targets.
Analyst agents then examined the filtered code using a workflow inspired by OpenAI’s Codex Security tooling, producing a complete list of candidate findings in less than half a day.
The next stage involved testing potential vulnerabilities inside isolated virtual machines. Triage agents generated proof-of-concept exploits and used Kernel Address Sanitizer instrumentation to reproduce crashes and validate suspected weaknesses. This stage confirmed 1,724 genuine vulnerabilities.
Subsequent agents classified the findings into information disclosure and privilege escalation vulnerabilities. ExploitDev agents then attempted to develop working exploits, while a final variant analysis process consolidated duplicate findings into unique vulnerabilities with corresponding candidate patches.
Only 74.7 percent of the initial candidates survived dynamic validation. Most unsuccessful attempts involved privilege requirements, race conditions and dependencies on fault injection. OpenAI attributed just 3.1 percent of the failures to model errors.
Human Review Strengthens Exploit Validation
OpenAI also identified weaknesses in its own validation process during earlier testing.
An initial campaign recorded 200 successful exploits according to the system’s internal measurements. However, human reviewers discovered that 20 of those exploits had achieved root access through vulnerabilities different from the ones originally assigned.
The company responded by tightening task constraints and introducing an independent verification process to ensure each completed exploit was associated with its intended vulnerability.
The testing environment also incorporated several security protections commonly enabled on modern Linux systems. These included Supervisor Mode Execution Prevention (SMEP), Supervisor Mode Access Prevention (SMAP), Kernel Address Space Layout Randomization (KASLR) and HARDENED_USERCOPY.
This ensured that the exploits were developed against a realistic security environment rather than deliberately weakened operating systems.
Research Campaign Costs Compared With Bug Bounties
The October campaign consumed approximately $1.21 million in API credits, equivalent to roughly $1,279 for each successfully developed root exploit.
Exploitation accounted for the largest portion of the expenditure. OpenAI described the reported figure as an upper-bound estimate, arguing that improvements to the research infrastructure and orchestration process could reduce costs across individual stages.
The company also compared its findings with historical vulnerability bounty valuations from competitions such as Pwn2Own and TyphoonPWN.
Using those benchmarks, the 948 exploits could theoretically represent approximately $66.3 million in bounty value. This would place the hypothetical valuation between 16 and 55 times higher than the cost of conducting the research campaign.
The system was also evaluated against Google’s hardened kernelCTF environment, where it produced 21 local privilege escalation exploits during a single campaign.
For comparison, the environment had accepted 26 confirmed zero-day local privilege escalation vulnerabilities from human researchers throughout the year. The result illustrates how automated systems could begin approaching the volume of vulnerability discoveries traditionally associated with extended human research efforts.
AI Discovers New Exploitation Techniques
Beyond identifying existing weaknesses, OpenAI reported that its agents developed at least 10 exploitation techniques that third-party kernel security experts described as unfamiliar.
These included persistent elastic objects used for cache spraying, page grooming techniques designed to improve exploit reliability, data-only privilege escalation methods and arbitrary type confusion.
The research also demonstrated how improvements in underlying models can reduce the need for complex supporting infrastructure.
A curated library of exploitation techniques initially improved GPT-5.5 Cyber’s success rate from 76.2 percent to 88.9 percent. However, GPT-5.6 Cyber achieved better results without relying on the additional library, leading OpenAI to remove that supporting component from its pipeline.
The campaign also identified a vulnerability in the QEMU testing environment itself. The issue involved QEMU’s Tiny Code Generator and was traced without access to its source code. Although the vulnerability had already been fixed upstream, the correction was missing from the release build used during testing.
Linux Maintainers Begin Addressing Findings
The research has already contributed to ongoing Linux kernel security improvements.
Within 10 days of the scanning and manual review process, 61 of the identified local privilege escalation vulnerabilities had received upstream patches. Additional fixes were being prepared, while hundreds of other findings remained under public discussion with maintainers.
The results also represent a substantial improvement over OpenAI’s earlier research. In a June disclosure, GPT-5.5 Cyber identified kernel vulnerabilities and developed 24 working exploits for validation and responsible reporting.
An earlier run using GPT-5.6 Sol in late July produced 166 exploits. Despite additional security hardening introduced into the Linux kernel during the intervening months, the October campaign generated more than five times that number.
Open-Source Security Faces a Changing Threat Landscape
OpenAI’s findings highlight the implications of increasingly capable AI systems for both vulnerability research and cybersecurity operations.
Automated systems that can identify vulnerabilities, validate their impact and develop working exploits could significantly accelerate defensive security research. However, the same capabilities also raise concerns about how quickly malicious actors could identify and exploit weaknesses in unpatched systems.
OpenAI warned that organizations should treat access to an unprivileged account on an outdated operating system as a potentially serious security risk when facing well-resourced threat actors.
The research reinforces the importance of timely security updates, vulnerability disclosure and coordination between AI developers and open-source maintainers. As automated exploitation capabilities continue to improve, the time available to identify and remediate vulnerabilities could become increasingly limited.
Source: https://www.artificialintelligence-news.com/news/openai-cyber-model-found-948-linux-kernel-exploits/
