Thought Leadership
An unreleased cyber-focused AI model reproduced 1,724 kernel vulnerabilities in just 30 hours. The cost came to $1,279 per exploit.
OpenAI has detailed an automated pipeline that uses an unreleased, cybersecurity-focused AI model to identify and exploit vulnerabilities in the Linux kernel and propose patches. During a run in mid-October 2026, the system analyzed 2,308 potential kernel flaws. It successfully reproduced 1,724 of them within 30 hours in an isolated testing environment. For 948 vulnerabilities, it generated working local privilege escalation (LPE) exploits that allow an unprivileged user to gain root access. It also produced proof-of-concept exploits for another 291 vulnerabilities that could expose sensitive information.
$1.2 Million in API Costs
According to OpenAI, the entire run consumed $1,213,430 in API credits, equivalent to $1,279 per LPE exploit. The tests were conducted on a widely used Linux distribution, which OpenAI did not identify. The company says its AI agents developed at least ten previously unknown exploitation techniques in the process. These included new methods for strategically placing objects in kernel memory, improving exploit reliability, and escalating privileges through data manipulation alone.
Five Stages With Human Oversight
The pipeline consists of five stages. First, AI agents identify security-sensitive areas of code that are accessible to low-privilege users and collect potential vulnerabilities. They then attempt to reproduce each finding in a sandbox, assess whether it can be exploited, and develop both an exploit and a corresponding patch. Finally, human security researchers review the exploit, patch, and proposed severity rating before the vulnerability is reported to the relevant maintainers. The reports do not specify how many of the identified vulnerabilities have already been disclosed or fixed.
“For the near and medium term, having access to a low-privileged account on an operating system, that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.”
OpenAI
OpenAI argues that the speed at which frontier models can discover vulnerabilities must be matched by automatically generated patches.
More Vulnerabilities Mean Faster Patching
According to Google Threat Intelligence Group, the number of publicly disclosed vulnerabilities more than doubled between January and August 2026, rising from 5,045 to 10,740 per month. On November 3, the UK’s National Cyber Security Centre (NCSC) stated that AI tools had very likely contributed to a significant increase in the number of discovered zero-day vulnerabilities. Organizations need to adapt their patching and testing processes to keep pace with this new speed. Anthropic also reported in October that an internal research model had developed exploit chains targeting Chrome, Safari, Windows, and Linux.
(Editorial Team)
