OpenAI has just shown the world something remarkable — and a little unsettling. Its AI security research team built a system that reads the Linux kernel, finds security holes, proves they are real by writing working exploits, and then writes the patches to fix them. The result, published on 4 November 2026: 948 working "root" exploits — nearly a thousand different ways an ordinary user account could take full control of a Linux machine.
This was not a publicity stunt. The Linux kernel is the software core of Android phones, cloud servers, supercomputers and most of the internet's infrastructure. Finding and fixing flaws in it is some of the most important security work there is. And for the first time, an AI did it at a scale no human team could match.
What "root" means — and why it matters
Every Linux system has a superuser account called root. Root can read any file, install anything and change any setting. Normal users and apps are deliberately kept away from that power. A local privilege escalation (LPE) vulnerability is a flaw that lets someone who only has a normal, unprivileged account climb up to root. That is the most dangerous kind of bug a system can have: once an attacker has root, the game is over.
The kernel is the part of the operating system that sits between your apps and the hardware. It manages memory, files, networking and device drivers — more than 40 million lines of code, according to OpenAI. Every one of those lines is a potential hiding place for a bug.
The five-stage pipeline
OpenAI's prototype was not one giant model doing everything. It was a pipeline of specialised AI agents, each handling one stage, with humans checking the work at the end:
- Scout agents read through the kernel's folders and picked out the code worth auditing — about 5,034 audit targets, roughly 2.8 million lines of code, or 7% of the whole kernel. That alone cut the cost of the audit enormously.
- Analyst agents read each target, worked out its threat model and hunted for flaws. Within 12 hours they produced 2,308 candidate findings.
- Validation agents tested each candidate in an isolated virtual machine running a Linux kernel with a memory-error detector (Kernel Address Sanitizer). They wrote small proof-of-concept programs and refined them until the bug actually triggered — or gave up. This step is what separates a real bug from a false alarm: 1,724 vulnerabilities were reproduced, about 75% of the candidates.
- Exploitability agents then tested whether the confirmed bugs could actually be turned into working exploits on a normal, fully protected Linux system — with all the standard defences switched on. They produced 1,169 working privilege-escalation exploits.
- Patch generation wrote a fix for each one, and human security researchers reviewed every exploit, patch and severity rating before anything was reported to the kernel maintainers.
After removing duplicates, the final count was 948 distinct vulnerabilities with working root exploits and candidate patches. The whole run cost about $1.2 million in API credits — roughly $1,280 per vulnerability.
For the technology behind all of this, see our plain-English guide to large language models.
The numbers at a glance
| Stage | Result |
|---|---|
| Audit targets identified | 5,034 (7% of the kernel) |
| Candidate findings | 2,308 |
| Vulnerabilities reproduced | 1,724 (~75%) |
| Working root exploits | 1,169 (948 unique after dedup) |
| Candidate patches written | 948 |
| Total cost | ~$1.2 million in API credits |
| Time from scan to finish | About 10 days |
The improvement over OpenAI's earlier attempt is striking. In July 2026, a run using GPT-5.6 Sol found and exploited 166 unique root vulnerabilities for about $514,000. The October run, with a newer (still unreleased) cyber model, found 948 for about $1.2 million. Stronger models find more bugs — which means code that was "already audited" is worth re-scanning as models improve.
The fixes are already flowing
This is the part that matters most. OpenAI says it has already sent hundreds of reports and patches for the most critical vulnerabilities to the Linux kernel maintainers, and is working with partners on the rest. By the time the scan finished, the maintainers had already fixed 61 of the root vulnerabilities upstream, with more patches in progress. That is the system working as intended: find, report, fix — before attackers find the same holes.
The researchers also discovered something unexpected. In a sample of 166 exploits, the agents used 10 exploitation techniques that were new — not just to the model, but to the independent kernel-exploitation experts OpenAI consulted. The details were deliberately withheld for safety reasons, but the message is clear: frontier models are not just copying known attack patterns. They are inventing new ones.
The uncomfortable side of the story
There is an obvious worry here. If an AI can find 948 root exploits for about $1,280 each, what stops someone else from building the same pipeline and using it offensively? OpenAI's answer is that the same capability in defenders' hands raises the cost for attackers: if flaws are found and fixed quickly, there is less to exploit. The researchers also note that running the pipeline on a stock, fully protected system — the same setup used in hacking competitions like Pwn2Own — means the results reflect real-world conditions, not a weakened target.
Still, the balance is delicate. The cost of finding a vulnerability is falling fast, and the race between finding and fixing is speeding up. The team argues that the only sustainable answer is more automated defence: keep scanning, keep patching, and keep software updated.
What this means for you
You do not need to understand kernel internals to take something practical from this. The kernel runs on your Android phone, your Chromebook, your home router and the servers behind nearly every website you visit. Every one of those devices gets safer when vulnerabilities like these are found and patched — and stays exposed when updates are ignored. The single most useful thing an ordinary user can do is the boring one: install updates promptly.
For the security world, the lesson is bigger. Vulnerability research used to be slow, skilled, expensive work — one researcher, one bug, weeks of effort. This run showed it can increasingly be run as a systematic process: thousands of candidates, hundreds of confirmed exploits, patches included, for about the cost of a small house. That changes who can audit the world's most important software — and how fast the fixes arrive.
If you want the backstory on how AI is already finding flaws in real software, read our explainer on how AI discovered a PHP flaw — and for the attacker's side of the equation, see how ransomware works.
For more on this, see our explainer on cybersecurity basics.
Takeaway checklist
- 948 root exploits — OpenAI's AI pipeline found, proved and patched nearly a thousand privilege-escalation flaws in the Linux kernel.
- The pipeline had five stages — scout, analyse, validate in isolated VMs, test exploitability, then generate patches, with humans reviewing everything.
- Cost: about $1.2 million in API credits, or roughly $1,280 per vulnerability — far cheaper than traditional human-only audits.
- Fixes are already landing — 61 of the flaws were patched upstream before the scan even finished; hundreds more reports are on their way to maintainers.
- Stronger models find more bugs — the July run found 166; the October run with a newer model found 948. Audited code is worth re-scanning.
- The agents invented 10 new exploitation techniques — frontier models are not just copying known attacks.
- Your move: keep your devices updated — every patch that lands only protects you if you install it.
