OpenAI's agents built 948 Linux root exploits for $1.21 million, but their self-reported results did not always hold up

OpenAI's Cyber team has described an automated pipeline that finds Linux kernel bugs, turns them into working exploits that give an ordinary user root access, and writes a patch for each underlying flaw. In a research post this week, OpenAI said it ran the pipeline in mid-October 2026 against the latest Linux kernel, using an upcoming cyber model it has not named. The run ended with 948 distinct local privilege escalation vulnerabilities, each with a working exploit, and cost $1,213,430 in API credits, about $1,279 per vulnerability. "Security research that once required a separate, sustained investigation for each finding can increasingly be run as a systematic process," the team wrote.

How the run narrowed down

Scout agents first picked out the parts of the kernel that low-privileged users can reach, leaving about 7% of the code base to audit. Analyst agents produced 2,308 candidate findings within 12 hours, and triage agents reproduced 1,724 of them inside isolated virtual machines within 30 hours. Exploit-development agents then produced 291 information-leak proofs of concept and 1,169 working root exploits, which traced back to 948 distinct vulnerabilities. A July 2026 run with GPT-5.6 Sol had found and exploited 166 unique vulnerabilities at a cost of $513,690. After 10 days of scanning and manual analysis, 61 of the bugs had been patched upstream, 43 had staging patches and 299 were being reported and discussed publicly. OpenAI put a hypothetical value of $18.9 million to $66.3 million on the exploits, based on past Pwn2Own and TyphoonPWN payouts, which Interesting Engineering notes is an illustrative comparison, not actual bounty income.

The agents' own reports needed checking

The agents' self-reported results did not always hold up. In an early run, the exploitation stage claimed 200 successful root exploits, but human review found that 20 of them had reached root through a different zero-day from the one the agent was assigned. "This suggests that even successful exploitation by agents needs proper validation," the post says. OpenAI tightened the task rules and added an independent check that each exploit uses the bug it was meant to, and security researchers review every exploit, patch and severity rating before anything goes to kernel maintainers. The researchers also warned that, for the near and medium term, access to a low-privileged account on a system that "isn't up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor."

Why it matters

The run puts a per-result price on agent work, and it shows that a result an agent reports is not yet a result a company can rely on: one in ten claimed exploits in the early run did something other than what was asked. Any business paying for agent output faces the same gap at smaller scale. Count work as done only after it has been checked against the task, and track the cost of that checking alongside the token bill when you judge what the agents produce.