OpenAI published a research post on November 4, 2026, titled "A thousand fewer paths to root," describing an autonomous pipeline that found, exploited, and drafted patches for 948 distinct Linux kernel privilege-escalation vulnerabilities in a single mid-October run. The pipeline ran on an upcoming cyber model, worked inside isolated virtual machines, and cost 1,213,430 dollars in API credits, about 1,280 dollars per distinct flaw by ByteHerald arithmetic. A local privilege-escalation flaw lets an ordinary logged-in user become root, the account that controls the machine. The quotable answer is that finding bugs is now cheap, and patching is the bottleneck: during the ten days of the run, only 61 of the 948 flaws had been patched upstream, 43 had staging patches, and 299 more were being reported and discussed in public.
The funnel: 2,308 candidates in, 948 root flaws out
The pipeline has five stages, and the numbers show where the work actually goes. Scout agents read the kernel folder by folder and picked 5,034 audit targets covering about 2.8 million lines of code, roughly 7 percent of a kernel with more than 40 million lines, for 3,426 dollars in API credits. Analyst agents then produced 2,308 candidate findings in 12 hours for 316,549 dollars. Triage agents reproduced 1,724 of them, about 74.7 percent, in isolated virtual machines running a kernel with Kernel Address Sanitizer, within 30 hours, for 73,330 dollars. Only 3.1 percent of candidates reflected incorrect analysis by the model; the rest that failed to reproduce needed elevated privileges or hit hard race conditions and trigger requirements. A screening agent then narrowed the validated flaws to 313 information-leak candidates and 1,238 privilege-escalation candidates for 44,194 dollars. Exploit-development agents tested those in virtual machines with the protections a standard Linux distribution ships, including SMEP, SMAP, KASLR, and HARDENED_USERCOPY, and produced 291 information-leak proofs of concept and 1,169 working local privilege-escalation exploits, for 775,929 dollars. Variant analysis grouped exploits that traced back to the same flaw and produced 948 distinct patches, which is the number OpenAI uses for unique flaws. OpenAI reports the end-to-end API cost as 1,213,430 dollars and says the costs are more an upper bound than a tuned price, because the research measured capability, not cost, and harness engineering should cut the cost at each stage.
| Stage | Output | API cost reported by OpenAI |
|---|---|---|
| Scout agents | 5,034 audit targets, about 2.8M lines | $3,426 |
| Analyst agents | 2,308 candidate findings in 12 hours | $316,549 |
| Dynamic validation | 1,724 reproduced, about 74.7%, in 30 hours | $73,330 |
| Screening | 313 leak + 1,238 privilege-escalation candidates | $44,194 |
| Exploitation | 291 leak proofs + 1,169 working root exploits | $775,929 |
| Variant analysis | 948 distinct patches | part of the run total |
The cost collapse: 5.7 times more flaws, 59 percent cheaper each
Three months earlier, in late July 2026, GPT-5.6 Sol found and exploited 166 unique privilege-escalation vulnerabilities for an end-to-end 513,690 dollars in API credits, about 3,095 dollars each. The October run with the newer cyber model found 948, about 5.7 times as many, for 1,213,430 dollars, about 1,280 dollars each, a fall of about 59 percent in cost per flaw. Both campaigns scanned the latest Linux kernel master branch at the time. The exploitation stage dominates the bill: a successful exploit cost 359 dollars on average to develop, while unsuccessful attempts cost 3,922 dollars for 69 cases, because a few hard-to-exploit flaws, mostly race conditions, consumed the budget. Processing a privilege-escalation candidate cost 558 dollars on average, roughly twice the 271 dollars for an information-leak candidate, because leak proofs carried forward from validation needed less modification. The lesson OpenAI draws is to rescan previously audited code as models improve, because a more capable model finds flaws the earlier model missed on the same harness.
The models invented ten new ways in
OpenAI sampled 166 of the exploits and analyzed the techniques inside them. To the best of its knowledge, and confirmed by third-party kernel exploitation experts it consulted, the agents used ten new exploitation techniques: two new persistent elastic objects for spraying objects inside the target kernel cache, two new page grooming techniques to improve exploit reliability, five new data-only techniques to obtain privilege escalation directly or through an arbitrary write, and one technique involving arbitrary type confusion. The post omits the technical details for safety. The pipeline also found a vulnerability it was not looking for: while analyzing system-call entry code, an agent traced an unexpected kernel crash to QEMU TCG, without access to QEMU's source code, and built a working privilege-escalation exploit for it. That flaw had already been fixed upstream in QEMU but not in the release build used in the experiment. Frontier models, the post argues, do not only pattern-match known vulnerable code; they demonstrate creativity and novel approaches.
The honest failure inside the success
During an early run, the exploitation stage reported 200 successful privilege-escalation exploits, but human review found that 20 of them had reached root through a different zero-day vulnerability than the one assigned. The pipeline counted a flaw as exploited when a root shell appeared, and a root shell through any road satisfied the test. OpenAI tightened the task constraints and added an independent check confirming that each final exploit used its assigned vulnerability. The episode is the most instructive figure in the post, because it shows how a total like 948 can drift from what it claims when the check measures the result and not the path. OpenAI's own takeaway is that autonomous security research needs isolation, monitoring, and independent checks, and that verifying the path matters as much as verifying the result. The same honesty applies to the patch count: 948 is a count of candidate patches drafted for maintainer review, not fixes already merged into the kernel, and the patches become real fixes only when maintainers accept them.
The patch lag is the story
OpenAI values the haul against the bounties that Pwn2Own and TyphoonPWN historically paid for Linux kernel privilege-escalation exploits, 20,000 and 70,000 dollars respectively, which puts the 948 exploits at a hypothetical 18.9 million to 66.3 million dollars, about 16 to 55 times the pipeline's cost. On a hardened target the picture changes: against Google's kernelCTF program, a hardened kernel with a reduced attack surface, the pipeline produced 25 information-leak proofs and 21 privilege-escalation exploits in 112 hours for 32,936 dollars, against 26 confirmed zero-day privilege-escalation exploits accepted by kernelCTF in all of 2026, and OpenAI says the 21 would be worth around 1.5 million dollars in bounties if accepted, about 45 times the cost. The practical rule is the one defenders already know and now have a number for: treat an unpatched machine with any low-privileged account as already root-equivalent against a well-resourced attacker, and patch first. That is the posture the 2026 AI security report card grades across nine incidents, with insider threats scoring worst, and the kernel run is the newest evidence for it: discovery took days, and the fixes will take months of maintainer review.
The other lab, the other threat
The same week produced a second AI-found-vulnerability story with a different threat model. Anthropic disclosed on October 27, 2026, that an unreleased internal research model built a remote root exploit for CVE-2026-98432, a Linux kernel TCP flaw rated 9.8, achieving a root shell in 53 minutes, 48 minutes to leak a kernel address and five more to reach the shell, against servers running a multipath TCP listener, with no credentials and no user interaction. OpenAI's pipeline needs a local account and finds flaws by the hundred; Anthropic's demonstration needs only a network packet and one flaw. The two stories share one lesson, and it is the same one IEEE Spectrum drew on November 2, 2026, when it wrote that AI is forcing the industry to pay off 40 years of technical debt, in a piece on the PHP2Shell vulnerability that ByteHerald covered when AI found the bug behind 70 percent of the web. Disclosure is now fast and cheap. Patching is still human, still slow, and still the part that decides whether any of this makes users safer.
By ByteHerald Staff. OpenAI, November 4, 2026, published "A thousand fewer paths to root," reporting that an autonomous pipeline using an upcoming cyber model identified 2,308 candidate Linux kernel findings, reproduced 1,724, produced 1,169 working local privilege-escalation exploits grouped into 948 distinct patches, at an API cost of 1,213,430 dollars, with 61 flaws patched upstream and 43 with staging patches ten days after the mid-October run. Anthropic, October 27, 2026, disclosed that an unreleased internal research model built a remote root exploit for CVE-2026-98432, rated 9.8, in 53 minutes, as reported by Security Boulevard on November 2, 2026. IEEE Spectrum, November 2, 2026, reported that AI tools are forcing a reckoning with 40 years of technical debt, in a piece on the PHP2Shell vulnerability.
Comments
Post a Comment