要点
- OpenAI research post (4 Nov 2026): “A thousand fewer paths to root”; primary cyber-team write-up of an autonomous discovery → validation → exploitability → patch → human-review pipeline.
- Mid-October 2026 run with an upcoming cyber model: 5,034 audit targets (~2.8M lines, ~7% of the kernel); 2,308 candidate findings; 1,724 dynamically reproduced (~74.7%); only 3.1% of remaining misses marked as incorrect analysis.
- Outcome: 291 information-leak proofs of concept and 1,169 working local privilege-escalation exploits; after variant analysis, 948 distinct escalations and candidate patches. Total API cost $1,213,430 (~$1,279 per escalation). Successful exploits averaged $359 in credits.
- Side run on a kernelCTF-style hardened environment: 25 information-leak proofs and 21 escalations for roughly $32,936. A July GPT-5.6 Sol campaign found 166 unique escalations for $513,690; the newer mid-October model found more than 5× novel escalations despite three months of intervening hardening.
- During the ~10-day campaign, OpenAI observed 61 escalations already patched upstream, 43 with staging patches, and about 299 under public discussion. The post argues sandboxes such as Firecracker and gVisor, plus automated patch generation with human review, are required defenses.
On 4 November 2026, OpenAI’s cyber team published a primary research note on an autonomous pipeline that hunted Linux kernel bugs at industrial scale. The headline number is 948 unique local privilege-escalation paths. The durable claim is narrower. Automated vulnerability discovery has scaled past human triage. Until automated patching and high-assurance software catch up, a low-privilege account on an unpatched system should be treated as functionally equivalent to root for a well-resourced actor. If later fully patched scans collapse novel escalations, or if maintainer and vendor patch velocity closes the window faster than models expand it, that claim fails.
[1]What the numbers actually say
Scout agents first picked 5,034 audit targets, about 2.8 million lines of code, or roughly 7% of the kernel, at $3,426 in API credits. Analyst agents then produced 2,308 candidate findings after deduplication in about 12 hours for $316,549. A validation stage that built proofs of concept under Kernel Address Sanitizer reproduced 1,724 findings, about 74.7%, in about 30 hours for $73,330. OpenAI says only 3.1% of the non-reproduced remainder reflected incorrect analysis; the rest needed elevated privileges, rare races, or more time.
Exploitability assessment then screened for plausible information leaks and escalations under stock desktop protections that block common kernel exploit tricks (SMEP, SMAP, KASLR, HARDENED_USERCOPY). The agents produced 291 information-leak proofs of concept and 1,169 working escalations that obtained root from an unprivileged local user. Variant analysis and patch drafting left 948 distinct escalations. The full run cost $1,213,430. Successful escalations averaged $359 in credits; OpenAI notes failed hard cases cost far more and should be cut with give-up rules.
A separate campaign against a kernelCTF-adapted hardened kernel produced 25 information-leak proofs and 21 escalations for about $32,936. OpenAI compares that to 26 confirmed 0-day escalations accepted by kernelCTF in 2026 at the time of writing, and to historical Pwn2Own / TyphoonPWN bounty bands that would value 948 stock-desktop escalations at a hypothetical $18.9 million to $66.3 million. Those bounty multiples are illustrative, not cash collected.
[1]Where the bottleneck moved
The operational lesson in the post is not that models suddenly invent every bug. It is that discovery and dynamic validation are no longer the scarce steps. Human researchers cannot manually triage thousands of candidates. Prioritization, exploitability proof, patch quality, and maintainer bandwidth are. OpenAI already sent hundreds of critical reports and patches under its Patch the Planet / Daybreak work and is staging the rest with partners.
Model generation matters. A July 2026 GPT-5.6 Sol run found 166 unique escalations for $513,690. The mid-October run with a newer cyber model found more than five times as many novel escalations on the then-latest master branch, after three months of community hardening. OpenAI also reports that stronger models needed lighter technique libraries: scaffolding that lifted GPT-5.5 Cyber from 76.2% to 88.9% success on 63 candidates added only about 1.5 points for GPT-5.6 Cyber.
The post’s defensive line is plain: for the near and medium term, a low-privileged account on software that is not current on available patches should be treated as root-equivalent for a capable adversary. Isolation layers such as Firecracker and gVisor shrink blast radius. Automated patch generation, iterated for style and variant coverage and then reviewed by humans, is framed as necessary to shrink the exploit window. OpenAI sampled 166 agent exploits and says agents used at least 10 techniques that were new to the authors and to outside kernel experts; full details are withheld.
[1]Steelman and gaps
Steelman. This is a first-party capability report, not an independent audit. Target choice, harness design, and what counts as “unique” after variant analysis are OpenAI’s. Bounty multiples use historical competition payouts, not money OpenAI collected. Linux maintainers already move fast: during the scan window alone, dozens of escalations were patched or staged and hundreds were under discussion. Attackers without OpenAI-scale API budgets face different economics. Some “successes” in an early run used a different 0-day than the assigned finding, which OpenAI caught and constrained with path checks. That episode shows agent wins need verification of the path as well as the shell.
Those caveats are real. They do not erase the checkable core: three-quarters of static candidates reproduced under sanitizers; hundreds of escalations worked on stock protections; cost per successful escalation sat in the low hundreds of dollars of API credits; and a newer model found far more novel issues after months of hardening. The scarce resource that follows from those facts is patch and isolation capacity, not another scout pass.
What the post does not close: how many of the 948 patches will merge unchanged; how often agent patches introduce subtle regressions; independent replication of the cost curves; and whether less-resourced actors can rent comparable pipelines soon.
[1]Who should care, and what to watch
Kernel and distribution maintainers should treat AI-scale report floods as a process problem: revalidate against tip-of-tree, prioritize by dynamic exploitability, and invest in patch review tooling. Cloud and device vendors should assume local footholds escalate unless sandboxing and rapid patching are in place. Security buyers evaluating “cyber” models should ask for validation rates, false-path rates, and patch acceptance, not only raw finding counts. Builders of agent harnesses should re-measure scaffolding each model generation instead of freezing last year’s technique packs.
Watch next: merge and revert rates for AI-assisted kernel patches over the next two release cycles; whether third parties reproduce order-of-magnitude similar escalation yields on current kernels; and whether Daybreak-style defender access plus automated patching measurably shortens time-to-fix for the classes of bugs this pipeline finds.
[1]Close
OpenAI’s usable sentence is not that Linux is uniquely broken. It is that when a mid-October pipeline can validate 1,724 bugs and produce 948 distinct local escalations for about $1.21 million, the defense problem has moved from finding needles to sewing patches and shrinking blast radius before the next model generation rescans. Six months on, either patch velocity and isolation will keep the window narrow, or unpatched local access will keep translating into root for anyone who can buy the scan.
[1]