OpenAI found 948 Linux root bugs; about 1 in 9 had fixes in 10 days

OpenAI said on November 4 that an automated research pipeline built on an unreleased cyber model found and exploited 948 distinct local privilege escalation bugs in the Linux kernel during a mid-October run. Each exploit lets an unprivileged local user become root. The run used $1,213,430 of API credits, which OpenAI puts at $1,279 an exploit, and the test machines ran what OpenAI describes as a stock desktop operating system on "a commonly used Linux distribution," with SMEP, SMAP, KASLR and hardened usercopy switched on.

OpenAI's own conclusion is the part IT teams should read twice. For now, it says, a low-privileged account on a system that is behind on patches is "functionally equivalent to root access" when the attacker is well resourced. That changes the risk math for every Linux host where someone other than an administrator can run code.

Answers to the first-day questions

Which distribution and which CVEs? OpenAI does not say. The post names no distribution, kernel version, CVE IDs or commits. On Hacker News, amluto, who says he used to handle private kernel security reports, asked OpenAI to share which of the bugs were already fixed or public. No list had been posted when we read the thread.

Are these kernel bugs or root-owned software? A commenter who says he wrote the pipeline, posting as ky1ebot1337, replied that "these vulns are all kernel specific" and that userspace programs running as root were out of scope.

How many are fixed? OpenAI's count from the end of its 10-day scan and analysis: 61 patched upstream, 43 with patches in staging and 299 being reported and discussed in public. That is 104 with a fix, about one in nine. By our arithmetic on OpenAI's figures, the other 545, or 57%, were in none of those groups. OpenAI says hundreds of reports and patches for the critical bugs are already with maintainers, and it will send the rest gradually through partners in its Patch the Planet program. No newer count has been published.

Will this happen again? Probably. A July run with an earlier model, GPT-5.6 Sol, found 166 such bugs for $513,690; the October model found more than five times as many. The pipeline's author wrote that, if compute permits, he plans to rescan Linux each time a stronger cyber model arrives. OpenAI also says that in a sample of 166 of the exploits, its agents used 10 exploitation techniques that outside experts had not seen, and it is withholding the details.

Why "patched upstream" is not the end of it

OpenAI scanned the kernel's master branch. Kernel maintainers were already bracing for a flood of AI-found bugs before the post. At the October 8 Maintainers Summit, LWN reported, Greg Kroah-Hartman said to expect a firehose of them for the next 18 months and that the only answer is to land fixes in the mainline fast. He also said the stable maintainers who carry fixes back to older kernels are already overwhelmed. Sasha Levin added that once a problem is found, any embargo is already over, because models can turn a patch into an exploit.

The UK's National Cyber Security Centre, in an assessment cited by The Hacker News, says organizations will have to change their patching and testing processes to keep up.

What IT teams should do

• Rank Linux hosts by who can run code on them. Shared jump boxes, CI and build runners, multi-tenant container hosts, VDI and shell servers come before single-purpose appliances where only admins log in.
• Shorten the kernel patch cycle on that first group, and make sure hosts actually reboot into the new kernel. Cyber Security News gives the same advice and also suggests limiting unprivileged user namespaces where workloads allow.
• Run untrusted or AI-agent code in stronger isolation. OpenAI names Firecracker and gVisor as ways to limit the damage from a kernel exploit.
• Ask your distribution vendor how it is tracking the AI-found kernel fixes and how fast they reach your supported kernel, and get the answer in writing for contract renewals.
• Watch the oss-security and distribution advisory feeds over the coming weeks. By OpenAI's figures, most of the 948 had not been made public when it stopped counting.