OpenAI Pipeline Discovers 948 Linux Privilege Escalation Vulnerabilities
OpenAI reported that its autonomous vulnerability research pipeline, during a Linux kernel scan in October 2026, reproduced 1,724 vulnerabilities, generated 948 exploits enabling local low-privilege users to gain root access, and produced 291 proof-of-concept (PoC) exploits for information disclosure. The total API cost was approximately $1.213 million, and the process uncovered at least 10 novel Linux exploitation techniques.
OpenAI's Pipeline Discovers 948 Linux Privilege Escalation Vulnerabilities
OpenAI reports that its autonomous vulnerability research pipeline reproduced 1,724 vulnerabilities during a Linux kernel scan in October 2026, and generated 948 exploits that could allow local low-privilege users to gain root access.
A single run dynamically reproduced 1,724 vulnerabilities and generated 948 usable local privilege escalation (LPE) exploits, enabling regular users to obtain root access.
Additionally, 291 proof-of-concept (PoC) exploits for information disclosure were found.
The total API cost was $1,213,430, averaging just $1,279 per successful LPE exploit (the actual cost of developing a successful exploit is even lower, at around $359).
Based on historical bounty levels from Pwn2Own / TyphoonPWN ($20,000–$70,000 per exploit), these 948 LPEs could theoretically be worth $18.9 million–$66.3 million, representing 16–55 times the cost.
At least 10 new Linux exploitation techniques were discovered (confirmed as novel by third-party experts), including:
- New persistent elastic objects (for cache spraying)
- A new page grooming technique
- A new data-only privilege escalation / arbitrary write technique
- Arbitrary type confusion
Source: OpenAI
