An autonomous pipeline from OpenAI reproduced 1,724 Linux kernel vulnerabilities and turned 948 of them into working local privilege escalation exploits. Every one gives an ordinary user account root access. The run cost $1,213,430 in API credits, roughly $1,279 per exploit.
The work is described in a November 4 research post. Exploit code was withheld, and the model behind it is an unreleased cyber build the company has not named.
Five stages and one human gate
Scout agents picked 5,034 audit targets, about 7 percent of the kernel, and analyst agents returned 2,308 candidates in twelve hours. A triage agent wrote proofs of concept and ran each inside a virtual machine with the kernel address sanitizer active, reproducing 1,724.
Exploit-development agents worked in machines with memory protections on. Variant analysis then collapsed 1,169 working exploits to 948 distinct bugs. Researchers reviewed every bundle before anything reached maintainers.
The number that matters is the cost of failure
Exploitation swallowed $775,929 of the total. Successful attempts averaged $360. The 69 that failed averaged $3,922 each, because agents burned budget on dead ends.
OpenAI also admits two rig failures. In an early run, 20 of 200 reported root exploits had reached root through a different bug than the one assigned. Separately, an agent traced a crash to a QEMU flaw the team had not patched, then built an escalation for it.
What it means for defenders
Older bounties paid $20,000 to $70,000 for a Linux kernel root exploit. At those rates the found bugs would be worth $18.9M to $66.3M, though no program would buy 948 of them.
The practical signal is narrower. At about a thousand dollars a bug, proving exploitability now costs less than the going bounty, and that pushes maintainers toward automated triage whether they want it or not.
