OpenAI's AI found and patched 948 Linux security flaws
An AI pipeline found 948 ways to seize full control of a Linux machine, for about $1,279 each.
OpenAI built a pipeline where an AI model searches for, proves, and even drafts fixes for security flaws in the Linux kernel (the core software at the heart of most servers, many phones, and much of the internet), almost entirely on its own. That matters because it shows AI can already do security work at a scale that used to take teams of human researchers, and it cuts both ways: it can make software safer faster, or hand attackers a shortcut, depending on who uses it first.
In a run in mid-October 2026, the pipeline, powered by an upcoming AI model built for security work, looked at 2,308 candidate flaws in the Linux kernel, then actually reproduced 1,724 of them inside an isolated test environment to confirm they were real. From those, it built working proof demonstrations, meaning code that proves a flaw can really be exploited, for 291 flaws that leak information and 948 flaws that let a low level user grab full root control of the machine. These are called local privilege escalation flaws, or LPE, and 948 of them is a large number for one run. The whole exercise cost $1,213,430 in fees to run the AI model, or $1,279 per working exploit found. The test machines were running a normal, fully updated desktop setup, not a deliberately weakened target, under the same rules used in real cybersecurity competitions.
Those competitions, Pwn2Own and TyphoonPWN, have historically paid bug bounties of $20,000 to $70,000 for a single Linux kernel LPE exploit. Apply those historical prices to the 948 exploits this run found, and the hypothetical payout would be $18.9 million to $66.3 million, somewhere between 16 and 55 times what the run actually cost. On a second, tougher test called kernelCTF, a version of Linux with much of the easy attack surface already removed, the pipeline still found 25 information leak proofs and 21 full exploits, for about $32,936. For scale, the entire kernelCTF bounty program had accepted only 26 confirmed new exploits in all of 2026 before this test. One pipeline run nearly matched a full year of outside researchers' work, worth roughly $1.5 million in bounties if all were accepted.
The pipeline works in stages: it first finds the security relevant parts of the kernel, scans them for candidate flaws, reproduces the promising ones in an isolated environment, builds a working exploit to prove the flaw is real, drafts a patch, and only then hands the whole package, the root cause, the proof, the exploit, and the candidate fix, to a human security researcher for review before anything is reported. This grew out of OpenAI's Patch the Planet effort. Back in June 2026, an earlier version of the model had already found Linux kernel flaws and built 24 working exploits. OpenAI says its pipeline used at least 10 exploitation techniques nobody had documented before.
The open source community moved fast too. In the 10 days while this scan was running, outside volunteers had already patched or drafted fixes for more than 100 of the same flaws, with roughly 300 more under public discussion. Capability is also rising quickly: this October run, using a newer model, found more than five times as many new flaws as a similar run in July did, even though three months of community patching happened in between.
OpenAI's own conclusion is blunt: within a few years, if a piece of software has a security flaw, a top tier AI model will probably be able to find it, and even a weaker model may be able to build a working exploit once the flaw is made public. Their practical advice is to treat any account on a machine that is not fully patched as functionally equivalent to a full takeover for a well resourced attacker, and to lean on sandboxing and isolation tools, such as Firecracker and gVisor, which wall off programs from the rest of the machine, to limit the damage if something does get in.