OpenAI Pipeline Reports 948 Linux Kernel Local Privilege-Escalation Findings

At a glance

The post date is November 4, 2026, from the OpenAI blog and @OpenAI. The run window is mid-October 2026, from the blog. The model is an unnamed upcoming cyber model, not a public product ID, from the blog and X. The pipeline runs from discovery through validation, exploitability, a patch, and human review, from the blog. Analysts produced 2,308 candidate findings, and triage dynamically reproduced 1,724, from the blog. The headline count is 948 unique local privilege-escalation vulnerabilities with working exploits and candidate patches, from the blog.

OpenAI also reports 291 information-leak proofs of concept and 1,169 working local privilege-escalation exploits before variant collapse, from the blog. API cost is $1,213,430 total, about $1,279 per LPE finding, from the blog. On novelty, OpenAI says “at least 10” techniques in a sample of 166 exploits were new to the researchers and to consulted experts, and withholds the details, from the blog.

What the pipeline did

OpenAI frames the work as a controlled research prototype on the Linux kernel, expanding June Patch the Planet results in which GPT-5.5 Cyber produced 24 local privilege-escalation exploits. Five stages run in sequence: scout and analyst discovery, dynamic validation in isolated virtual machines (with KASAN), exploitability assessment under stock desktop mitigations (SMEP, SMAP, KASLR, and HARDENED_USERCOPY), patch generation, and human security-researcher review before maintainer reports.

In the mid-October run, Scout agents selected 5,034 audit targets (about 2.8 million lines, about 7% of the kernel). Analysts produced 2,308 candidate findings in about 12 hours. Triage reproduced 1,724 (about 74.7%) within about 30 hours; OpenAI says only 3.1% of non-reproduced cases reflected incorrect analysis that assumed an impossible condition. ExploitDev then produced 291 information-leak proofs of concept and 1,169 working local privilege-escalation exploits; variant analysis yielded 948 distinct patches, which OpenAI uses as the unique-LPE count.

Outputs bundled for humans include a root-cause analysis, a minimal crashing proof of concept, a candidate patch, and a full exploit used to judge severity—not as a public exploit dump. OpenAI says it has already sent hundreds of critical reports and patches upstream and is working with Patch the Planet partners on the rest. Candidate patches are for maintainer evaluation; they are not claimed as already-merged fixes.

Numbers that need careful wording

A headline of “948 usable local privilege-escalation exploits” matches OpenAI’s count of unique findings, but the blog also reports 1,169 working LPE exploits before variant analysis. Cost is given as $1,213,430 in API credits ($1.2 million in the X summary). Hypothetical bounty comparisons to historical Pwn2Own ($20,000) and TyphoonPWN ($70,000) LPE awards are OpenAI arithmetic ($18.9 million to $66.3 million, about 16–55 times cost)—not paid bounties.

On an adapted kernelCTF-style target, OpenAI reports 25 information-leak proofs of concept and 21 LPE exploits for about $32,936, versus 26 confirmed zero-day LPEs accepted by kernelCTF in 2026 at the time of writing. A July GPT-5.6 Sol scan found 166 unique LPEs; the October cyber-model scan found 948 on the then-latest master branch despite intervening hardening—OpenAI’s own before-and-after, not an external replication.

On novelty, researchers sampled 166 exploits and say agents used at least 10 techniques new to them and to consulted third-party kernel experts. For safety, the post omits technical details. This article follows that limit: no exploit steps, payloads, or technique recipes.

OpenAI also notes process failure modes: in an early run, 20 of 200 “successful” LPE marks achieved root via a different zero-day than the one assigned, prompting tighter path checks. During the main scan’s roughly 10 days, maintainers and others had already patched or staged 104 LPEs and were publicly discussing about 300 more.

Bottom line

OpenAI’s November 4 security post is a first-party capability and process report: an upcoming cyber model inside a human-reviewed pipeline produced hundreds of validated Linux local privilege-escalation cases and candidate patches at roughly million-dollar API cost, while withholding novel exploit details and routing disclosure through maintainers. Treat counts, costs, novelty, and bounty multiples as OpenAI’s measurements in a research setting—not as proof that 948 public exploits were released, and not as guidance for offensive use.