OpenAI revealed on November 4, 2026 that a five-stage agentic pipeline running its upcoming, still-unreleased cyber-focused AI model scanned the Linux kernel and produced working exploits for 948 unique local privilege escalation (LPE) vulnerabilities — flaws that would let an unprivileged local user gain root access.

In a mid-October run, the pipeline analyzed 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities, and generated proofs of concept for 291 information leaks and 948 distinct LPEs, all completed within 30 hours.

The total run cost $1,213,430 in API credits — $1,279 per unique exploit.

The result dwarfs OpenAI's own June 2026 milestone, when its GPT-5.5-Cyber model surfaced 24 LPE exploits.

According to unite.ai, a July run using GPT-5.6 Sol found 166 unique LPEs at a cost of $513,690 — meaning the October run delivered more than a fivefold increase in novel exploits despite three months of kernel hardening between scans.

India Today adds that applying historical Linux kernel bounty rates of $20,000 at Pwn2Own and $70,000 at TyphoonPWN would value the 948 flaws at roughly $18.9 million to $66.3 million, about 16 to 55 times the pipeline's cost — an illustrative valuation rather than actual bounty income.

OpenAI says the agents discovered and used at least 10 Linux exploitation techniques that both its team and third-party kernel experts judged novel, including two new persistent elastic objects for kernel-cache object spraying, two new page-grooming techniques, five data-only privilege escalation methods, and one arbitrary type confusion technique.

Crucially, testing targeted a stock desktop kernel with SMEP, SMAP, KASLR and HARDENED_USERCOPY enabled — not a deliberately weakened target.

unite.ai reports the agents selected 5,034 audit targets covering roughly 7% of the kernel's 40 million lines, and that human review caught 20 of 200 early exploits that had rooted the machine through a different bug than the one assigned.

The findings land amid a broader AI-driven surge in vulnerability discovery. The U.K. NCSC's assessment published Tuesday states that AI-powered cyber tools have almost certainly led to a significant increase in zero-day discovery, even as defensive tools shorten the zero-day-to-N-day window.

The Hacker News cites Google Threat Intelligence Group figures showing monthly vulnerability disclosures more than doubled from 5,045 in January 2026 to 10,740 in August 2026, with high-risk disclosures up 167%.

OpenAI warns that for the near and medium term, a low-privileged account on an unpatched system should be treated as functionally equivalent to root access for a well-resourced attacker.

OpenAI says it has sent hundreds of reports and candidate patches for critical vulnerabilities to the Linux kernel community under its Patch the Planet initiative, with human researchers reviewing every exploit, patch and proposed severity before disclosure — the 948 figure counts unique vulnerabilities, not merged fixes.

unite.ai notes the bottleneck has shifted from generating leads to proving exploit paths and producing fixes maintainers will actually accept, making independent verification central.

OpenAI argues vulnerability discovery by frontier models must now be matched by automated patch generation to limit the exploitation window, though the company has not said when the underlying model will be released.