OpenAI says an AI pipeline built 948 Linux root exploits in one run for $1,213,430, a price that undercuts the $20,000 bounties historically paid for a single one. The figure holds as a cost, but the exploits need a foothold on the machine first, and the counts circulating around it do not match. Patch deployment is now the weak point, not discovery.
Table of Contents
The price of a working Linux root exploit has fallen from five figures to four, at least in OpenAI’s own accounting. In a run against the kernel’s master branch in mid-October, its pipeline of AI agents produced exploits for 948 distinct local privilege-escalation flaws at $1,279 each, according to a research post OpenAI published on 4 November 2026. The contests that set the old benchmark, Pwn2Own and TyphoonPWN, have paid $20,000 and $70,000 for one such exploit. Anthropic had shown a different kind of kernel result a week earlier, so the field is moving on two fronts at once.
The Code Report, a YouTube video that dates itself to 9 November 2026, turned those numbers into a quick verdict that $1.2 million was a bargain. The verdict is defensible. The arithmetic around it mixes several counts, though, and the exploits it describes cannot be launched from the internet. The sections below check those points against OpenAI’s published figures, the reporting that reproduced them and the Linux kernel’s own documentation. The video also carries a paid segment for a code-review tool.
The funnel from 2,308 candidates to 948 exploits
OpenAI describes the run as a chain of stages. A first agent cut the kernel down to code that an unprivileged user can reach, which came to 5,034 audit targets and about 2.8 million lines, roughly 7% of the kernel. Analysis of those targets produced 2,308 candidate findings, and triage then reproduced 1,724 of them dynamically in an isolated environment. The last stage turned reproduced bugs into working root exploits against a stock desktop operating system with its normal protections on, attached a patch candidate, and handed everything to a human security researcher before anything reached kernel maintainers.
The model behind the run is GPT-6 Cyber, announced on 5 November and rated Critical for cybersecurity under OpenAI’s Preparedness Framework, one step above the High rating of GPT-5.6 Cyber. Access is limited to approved customers of the Daybreak Red program, with wider access promised gradually. OpenAI reports 48.5% on its ExploitGym benchmark against 32.1% for the previous model, and says GPT-6 Cyber stayed inside its authorised scope in 99.93% of honeypot tests, up from 94.49%. Every one of those scores is OpenAI’s own.
Three counts that do not agree
The video says the exploit stage produced 1,169 working root exploits, then divides the bill by 948 to reach about $1,280 each. Both numbers appear in ITLAB’s summary of OpenAI’s report, which lists 1,169 root exploits and 948 distinct flaws and notes that OpenAI treats a flaw as unique only when it has its own patch. So $1,279 is a price per distinct flaw. Spread over all 1,169 exploits the same bill would come to about $1,038 each, a figure from simple division rather than anything OpenAI states.
The $50 million bounty value needs the same care. The video says OpenAI has historically paid around $20,000 for one kernel exploit. The $20,000 and $70,000 figures are past payouts at the Pwn2Own and TyphoonPWN contests, and OpenAI multiplied them by 948 to reach a hypothetical $18.9 million to $66.3 million, or 16 to 55 times the run’s cost. CSO Online notes that the comparison does not describe real payouts or show that every finding would qualify for one. The July comparison does hold. An earlier GPT-5.6 Sol run found 166 exploits for $513,690, about $3,100 each, so the new run delivered more than five times as many exploits at under half the unit price.
Local escalation is not a break-in
Each of the 948 exploits turns an ordinary account into root. None lets a stranger onto a machine from the internet, because the attacker needs a foothold first, such as a vulnerable web application or stolen credentials. ITLAB stresses that limit, and OpenAI’s own conclusion is that an unprivileged account on an unpatched system should be treated as close to root against a well-resourced attacker.
The video presents Anthropic’s late-October result as the warm-up for OpenAI’s reply, but the two are different kinds of finding. Anthropic’s Frontier Red Team described a zero-click remote chain against Linux servers that run a Multipath TCP listener, tracked as CVE-2026-98432 and rated 9.8. Its proof of concept needed about 53 minutes from memory leak to root command, with 48 minutes to leak a kernel address and five more to finish. That is one flaw with a network attack path and a narrow condition, against hundreds of flaws with a local one. The Hacker News adds a caution: the public record for that CVE describes an IPv4 TCP fix, and the link to the Multipath TCP chain rests on Anthropic’s own post.
Fixes are the slow half
OpenAI sent maintainers 304 critical findings with candidate patches and says the rest are going out gradually through its Patch the Planet program. CSO Online reports that the post gives no complete remediation breakdown for all 948, and ITLAB says it is unknown how many OpenAI patches have reached a released kernel. During the ten days the scan ran, other contributors patched 61 of the flaws upstream, had 43 in staging and were discussing 299 in public. This looks like the same bugs surfacing in several places at once, which is an inference, not something OpenAI states.
Human review was needed from the start. In an early run, 20 of 200 apparently successful exploits had reached root through a different zero-day than the one assigned. OpenAI also admits that early patches sometimes added needless code or missed related variants. IDC research director Sakshi Grover told CSO Online that the risk lies less in the 948 than in the window between discovery and production fixes, since an upstream patch does not mean the distribution kernel on a company’s servers has it.
Maintainers were overloaded before this
The kernel project changed its rules for AI-found bugs almost six months before OpenAI’s post. Documentation merged for Linux 7.1 in mid-May, written by Willy Tarreau, says a bug found with AI help must be treated as public, because such bugs tend to surface with several researchers on the same day, and that reproducers should not be posted. It adds that a large share of reports to the private security team now come from AI-assisted reviews and that poor ones overload maintainers. Linus Torvalds said that month the security list had become almost entirely unmanageable.
The volume kept rising. The kernel’s CVE team published 432 CVEs over two days in July, according to The Register, and Risky Bulletin counted 442 over three days, mostly low severity and likely but not confirmed to be AI-assisted. Vendors adjusted their schedules, with Oracle moving from quarterly to monthly security patches and Adobe from monthly to twice-monthly. Jan Schaumann of Akamai told The Register that frequent automated updates look like the only workable response, and that many large organisations, held back by long QA cycles and support contracts, cannot adopt them.
Limits of OpenAI’s own numbers
Every headline figure here is OpenAI’s, and ITLAB found no independent reproduction as of 6 November. OpenAI withheld the details of at least ten new exploitation techniques it says the agents used, and it did not name the desktop distribution it attacked, so the video’s guess of Arch is only a guess. The scanned 7% was chosen because unprivileged users can reach it, which does not allow an estimate of how many flaws sit in the other 93%. ITLAB also found no reports of attacks using these flaws.
The video closes with a paid segment for Greptile, an AI code-review tool, and its advice to developers to review code before shipping comes with that sponsor. OpenAI’s own advice is different: keep kernels patched and isolate untrusted code.
Patch speed is the number to watch
For anyone who runs shared Linux hosts, container platforms or build runners, the useful reading is conditional. If untrusted code or many users share one kernel, a local root exploit is the step that matters, and the interval between a fix landing upstream and running on your machines has to shrink. ITLAB’s checklist is plain: boot into new kernels instead of only installing them, treat unprivileged accounts as a real risk, close whatever supplies the first foothold, isolate untrusted code with layers such as gVisor or Firecracker, and ask hosting providers how fast they backport kernel fixes.
The evidence supports this much now: AI can find and exploit kernel bugs at somewhere between $1,279 and about $3,100 apiece, and the same pipeline writes the fix. It does not show that attackers use it at that scale. A report of in-the-wild use of one of the 948, or a published count of how many OpenAI patches have reached released kernels, would change that judgment.
Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency
This article is an original analysis supported by the sources cited below
OpenAI spent $1.2 million hacking Linux… and it was a bargain
The video whose claims the article tests: the pipeline stages, the 1,169 and $1,280 figures, the $50 million bounty value, the Anthropic comparison and the sponsor segment.
Security bugs
The kernel’s own rule that AI-found bugs are treated as public, with its warning about overloaded maintainers and requirements for AI-assisted reports.
OpenAI built an AI pipeline to find, exploit and patch Linux flaws
OpenAI’s cost, the 16 to 55 times bounty comparison and its caveat, the patch status during the scan, the 20-of-200 error and the IDC view on the patch window.
OpenAI and the 948 Linux kernel flaws
The table separating 1,169 root exploits from 948 distinct flaws, the 7% code coverage, the local-only limit, the lack of independent verification and the defensive checklist.
A Thousand Fewer Paths to Root: 948 Linux Exploits for $1.2 Million
A summary of OpenAI’s report covering the pipeline stages, the stock desktop target, the $1,279 price and the bounty values of $18.9 million to $66.3 million.
OpenAI launches GPT-6 Cyber to find and fix security flaws
The GPT-6 Cyber launch figures: the Critical rating, ExploitGym and honeypot scores, the 304 critical disclosures and restricted Daybreak Red access.
Anthropic AI model finds Linux kernel bug that leads to remote root access
Anthropic’s remote root chain against Multipath TCP listeners, its 9.8 rating, the 53-minute proof of concept and the distribution patch status on 30 October.
Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
The 48-plus-5-minute split of Anthropic’s Linux chain and the caution that the CVE record and Anthropic’s description are linked only by its own post.
Linus Torvalds Merges New Linux Kernel Security Bug Guidelines
The May 2026 merge of Willy Tarreau’s security-bug documentation into Linux 7.1 and its rules for AI-assisted reports.
Linux kernel team publishes 432 CVEs in two days
The July CVE flood, Torvalds’s May remark about the security list and the Akamai view that frequent automated updates may be the only workable response.
Risky Bulletin: Linux kernel discloses 442 CVEs as AI bugpocalypse settles in
The 442-CVE count over three days, their mostly low severity and the shift to faster patch cycles at Oracle and Adobe.
| Citing this article? Brief excerpts are welcome. Please credit Webiano.digital, name the author where stated, and include a link to https://webiano.digital and to this original article. Full or substantial republication requires prior written permission. Read our Copyright and Content Use Policy. |
This article was prepared with the assistance of artificial intelligence tools. The content underwent expert human review, and Webiano Digital & Marketing Agency assumes editorial responsibility for its final version and publication.
