At 00:00 Beijing Time on November 4, 2026, OpenAI announced an automated security research initiative targeting the Linux kernel. The company stated that during a mid-October run, 2,308 deduplicated candidates were initially obtained, followed by dynamic reproduction of 1,724 issues; after exploitation testing and variant analysis, the final result yielded 948 distinct patches as the sole number of local privilege escalation vulnerabilities. All methods, costs, and results mentioned above originate from OpenAI's own research records, and existing independent media metadata has not audited these technical conclusions.
Discovery and Validation Layering
This prototype connects vulnerability discovery, dynamic validation, exploitability assessment, candidate patch generation, and manual review into a single pipeline. The model is responsible for locating code, constructing reproduction examples, attempting exploitation, and proposing fixes, while human security researchers then examine root causes, crash evidence, exploitation paths, and patches to determine whether to report to Linux maintainers. The pipeline organizes root cause analysis, minimal crash examples, candidate patches, and complete exploits for each item to assist researchers in assessing severity. Official materials did not state that the model could bypass the maintenance process to merge code independently, nor did they disclose the total number of patches ultimately accepted upstream.
During the discovery phase, the Scout agent selected 5,034 audit targets from the Linux kernel, covering approximately 2.8 million lines of code, which accounts for about 7% of the entire kernel codebase. OpenAI stated that the Linux kernel's total size exceeds 40 million lines of code, with system calls, networking, file systems, and device drivers collectively forming a broad attack surface. The Analyst agent subsequently analyzed these targets and generated 2,308 deduplicated candidates within 12 hours. OpenAI positioned this stage as screening suspicious code rather than confirming security vulnerabilities; candidates must be reproduced in isolated environments before entering impact assessment and patching workflows.
Using Quantity for Deduplication
Dynamic verification uses isolated virtual machines with kernel address sanitizers enabled, where Triage agents write minimal reproduction programs for candidates and observe program output and system console. OpenAI stated that the system reproduced 1,724 issues within 30 hours, accounting for about 74.7% of candidates. Among non-reproduced items, some require higher privileges, others involve race conditions, specific memory allocation failures, or time-consuming reference count wrapping, while another 3.1% come from the model's erroneous analysis of impossible conditions, thus 2,308 cannot be written as all confirmed vulnerabilities.
Subsequent evaluation first filters out items that may cause information leakage or local privilege escalation, then has exploitation development agents test in protected virtual machines. Official materials list 291 proof-of-concept instances of information leakage and 1,169 successful local privilege escalation exploits; variant analysis subsequently forms 948 different patches, and OpenAI calculated 948 unique LPE vulnerabilities based on this. Successful exploitation instances and deduplicated vulnerabilities are not the same unit, and these two figures cannot be interchanged.
Cost and Testing Boundaries
The experimental objective was configured with standard desktop operating system settings, with SMEP, SMAP, KASLR, and HARDENED_USERCOPY protections enabled. The research scenario assumes that the attacker already possesses a low-privilege local account, then tests whether root privileges can be obtained; it does not report direct network-based host intrusions, nor does it provide evidence that such exploits are currently appearing in real-world attacks. The actual affected scope across different distributions, kernel versions, and devices is not provided with a complete list on the official pages.
OpenAI's total pipeline run cost was 1,213,430 USD in API credits, equivalent to 1,279 USD per unique LPE vulnerability. The figures recorded here represent model invocation credits, not repair fees paid to maintainers, nor the actual costs of attackers implementing actions. The company also conducted hypothetical comparisons using historical vulnerability bounties, but did not receive corresponding bounties, nor did it list these figures as revenue. The costs correspond only to this particular model, target configuration, and research process; OpenAI describes it itself as an upper bound estimate that could potentially be reduced through subsequent tool engineering, with no independent accounting available from existing sources.
Patch Progress Still Awaiting Confirmation
Scanning and manual analysis have continued for 10 days. OpenAI stated that during this period, 61 LPEs have already been patched by other upstream work, 43 have entered staging patches, and another 299 are in public reporting or discussion; these overlapping records cannot all be counted as new fixes from OpenAI. The company indicated that its team has begun sending reports and patches for critical issues, and is gradually processing the remaining items with collaborators, but did not disclose the receiving, merging, or release backport status of each patch.
QuantumBit authorized information flow published a headline and short summary on November 5th Beijing time, independently confirming the public incident involving 948 vulnerabilities and approximately $1.2 million in costs; this article does not use the main content or images from that media outlet. Current public information still cannot confirm the model name, complete upstream processing results of all patches, precise impact scope across various Linux distributions, or any in-the-wild exploitation. OpenAI's page also does not refer to all candidates as vulnerabilities, nor does it call the 1,169 exploitation instances 1,169 unique issues.