OpenAI’s model found 948 Linux root bugs at about US$1,280 each

01The line: 24, then 166, then 948

June. Announcing Patch the Planet, a programme with Trail of Bits to help open-source maintainers, OpenAI said GPT-5.5-Cyber had produced 8 kernel information-leak proofs of concept and 24 local privilege-escalation exploits, “the subset for which PoCs were automatically generated” out of hundreds of issues identified. It gave no cost.²

Late July. While building a full pipeline, GPT-5.6 Sol “found and exploited 166 unique LPE vulnerabilities for an end-to-end $513,690 cost in API credits”. Mid-October. The newer, unreleased cyber model found and exploited 948 for US$1,213,430. Both runs scanned the latest kernel master branch of the time.¹

OpenAI adds two caveats. It “focused on methodology and measuring model capability ... not cost”, and expects better engineering to cut every stage, so its figures are “more an upper bound”. And failures were dear: 69 exploit attempts that never succeeded cost an average of US$3,922 each, against US$360 for each of the 1,169 that did.¹

02How 2,308 suspicions became 948 bugs, and 61 fixes

“Scout” agents first picked 5,034 audit targets reachable by low-privileged users: about 2.8 million lines, roughly 7% of the kernel. “Analyst” agents read them and, within 12 hours, produced 2,308 candidate findings. A triage agent then wrote a proof of concept for each and ran it in an isolated virtual machine with the Kernel Address Sanitizer, which reports memory corruption as it happens; within 30 hours 1,724 reproduced, 74.7%. Only 3.1% of candidates were wrong analysis; most of the rest needed elevated privileges or were races too hard to trigger in the time allowed.¹

Exploit-writing agents then attacked 1,238 privilege-escalation candidates on machines with the protections a standard distribution turns on (SMEP, SMAP, KASLR, hardened usercopy), and got a root shell 1,169 times. Variant analysis folded those into 948 distinct bugs, each with a patch the model wrote.¹ An early run showed why a person still checks: of 200 reported successes, 20 had reached root “through a different 0-day vulnerability” than the one assigned.¹

03Why the queue moves to the maintainers, and what to watch

OpenAI’s own summary: “Vulnerability discovery is becoming easier to scale, but prioritization and validation remain operational bottlenecks.” Following the kernel community’s guidance, it began with the critical bugs, has sent “hundreds of reports and patches”, and is releasing the rest gradually through Patch the Planet partners.¹ In June the same programme warned that models “produce a high volume of false positives that can contribute to the already overwhelming backlog maintainers are facing”.² The kernel already issues more CVE identifiers than anyone: since it became its own numbering authority in 2024 it went “from nothing to number 3 in 2024 to number 1 in 2025”, in Greg Kroah-Hartman’s words.³

The economics run the other way for an attacker. OpenAI applies past Pwn2Own and TyphoonPWN prizes for a Linux root exploit (US$20,000 and US$70,000) to the 948 and gets what it calls “a hypothetical valuation” of US$18.9m–66.3m, 16 to 55 times its cost. Against Google’s hardened kernelCTF target the pipeline produced 21 root exploits for about US$32,936; kernelCTF had accepted 26 confirmed zero-day root exploits so far in 2026, at the time of writing.¹

What to watch: how many of the 948 reach upstream and the stable kernels distributions ship; whether OpenAI releases the model it calls “upcoming”; and the next rescan, which OpenAI recommends “as model capabilities improve”.¹