An unreleased OpenAI model discovered and exploited 948 (!) local privilege escalation vulnerabilities in the Linux kernel in a single run. It would have cost $1.2 million if OpenAI had paid itself based on API credits. The system also wrote a patch for each vulnerability.
The OpenAI model initially identified 2,308 candidate findings. Ultimately, 948 unique vulnerabilities remained that would grant a non-privileged user root access. It is not entirely clear how much overlap there is between exploits, but even a tenth of this number would have been remarkable.
The VMs were running a standard desktop distribution, with protections such as SMEP, SMAP, KASLR, and HARDENED_USERCOPY enabled. The test yielded $1,279 per exploit. As a reference to what these exploits would have been worth individually: Pwn2Own and TyphoonPWN historically paid out $20,000 to $70,000 per Linux kernel LPE (Local Privilege Escalation).
In July, GPT-5.6 Sol found another 166 unique LPEs. The new model thus found more than five times as many, even though the kernel had been further secured over the three months between the two scans. According to OpenAI, the agents also used at least ten exploitation techniques that even external kernel experts were not yet aware of. The company is keeping the details of these to itself for security reasons, but we will likely learn about them eventually.
Five phases
Scout agents first selected 5,034 so-called audit targets. These comprised about 2.8 million lines of code, roughly 7 percent of the kernel. Analyst agents extracted the candidate findings from these within twelve hours. Triage agents then built proofs-of-concept in VMs using KASAN. Only 3.1 percent turned out to be based on a flawed analysis. After the exploit and patch phases, human researchers review everything.
This is a rare insight into how these models identify vulnerabilities, though the explanation remains vague, and may even be a mystery to OpenAI itself, since an LLM doesn’t always do what it says it does or reveal its reasoning processes in full.
Pressure on maintainers
Linux vulnerabilities have been pouring in this year, serving as proof of the wide range of cyber threats that have been lurking as zero-days for years or even decades. Linus Torvalds previously criticized the flood of AI bug reports, so the work of hobbyists to protect the kernel using AI-generated submissions is certainly not appreciated. OpenAI itself is working through an initiative called Patch the Planet, in collaboration with Trail of Bits, among others, and is prioritizing the reporting of critical cases this time. The rest of the vulnerabilities will follow.
Ten days after the scan began, 61 of the LPEs had already been patched upstream, 43 had a staging patch, and 299 were being publicly discussed. Nevertheless, OpenAI warns that, for the time being, an account with limited privileges on an unpatched system is “functionally equivalent to root access” for an attacker with sufficient resources.