AnswersPublished16 sources
OpenAI Reports 948 Linux Kernel Privilege-Escalation Flaws in One AI Pipeline Run
OpenAI says its prototype Linux security pipeline reproduced 1,724 vulnerabilities and generated candidate patches for 948 distinct privilege escalation flaws in one run, costing $1,213,430 in API credits. The pipeline moved from 2,308 candidate findings to 1,724 reproduced vulnerabilities, then to 948 distinct loca...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- OpenAI says its prototype Linux security pipeline reproduced 1,724 vulnerabilities and generated candidate patches for 948 distinct privilege escalation flaws in one run, costing $1,213,430 in API credits.
- The pipeline moved from 2,308 candidate findings to 1,724 reproduced vulnerabilities, then to 948 distinct local privilege escalation flaws.
- After 10 days, reporting put 61 flaws as patched upstream, 43 with staging patches, and 299 under public discussion—evidence that remediation takes longer than discovery.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What did OpenAI’s November 4, 2026 research announcement reveal about its prototype autonomous security pipeline’s mid-October run against t. Article summary: OpenAI’s November 4 announcement, “A thousand fewer paths to root,” reported that a prototype autonomous pipeline discovered, validated and generated candidate patches for 948 distinct Linux local privilege-escalation vu. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
OpenAI’s November 4, 2026 research announcement describes a prototype pipeline that searched the Linux kernel for security flaws, tested candidate findings in a controlled environment, and generated patches. The company reported 2,308 candidate findings, 1,724 reproduced vulnerabilities, and 948 distinct local privilege-escalation flaws, at a total API cost of $1,213,430.2 The headline result is substantial, but it is a company-reported research run—not evidence that 948 fixes have shipped.
From code audit to reproduced vulnerabilities
The pipeline’s reported counts describe different stages, not interchangeable totals: agents first identified candidate findings, then attempted to reproduce them, and ultimately produced exploits and candidate patches for the distinct privilege-escalation flaws.2
Reporting on the audit says the system narrowed its work to 5,034 targets covering about 2.8 million lines of code, roughly 7% of the kernel.22 OpenAI’s research summary confirms the central stages: 2,308 candidate findings and 1,724 dynamically reproduced vulnerabilities.
2
A separate report gives a further exploit-stage total of 1,169 working privilege-escalation exploits associated with 948 distinct vulnerabilities.35 That distinction matters: multiple exploit attempts or variants can relate to fewer unique flaws. OpenAI’s own summary states the main result as 948 local privilege-escalation exploits.
2
What the $1.21 million figure means
OpenAI reported a total API cost of $1,213,430 for the run.2 Dividing that total by 948 distinct privilege-escalation vulnerabilities gives about $1,279 per flaw. That is a simple average of the reported cost, not a measure of the full cost of security research, human review, responsible disclosure, or applying fixes.
For context, reporting describes a late-July run using GPT-5.6 Sol that found 166 unique vulnerabilities for $513,690. On those reported counts, the October run produced about 5.7 times as many distinct privilege-escalation findings, at a higher total cost.31 The comparison is a useful scale marker, but the available information does not establish that the two runs had identical scope or conditions.
Candidate patches are not completed fixes
OpenAI characterized the system as a discovery, exploitation, and patching pipeline, and said it generated patches alongside its findings.2 But creating a candidate patch is only one step: maintainers must review and accept changes before they become upstream fixes.
A status summary reported 10 days after the run listed 61 vulnerabilities patched upstream, 43 with staging patches, and 299 being reported and discussed publicly.17 Reporting also says OpenAI sent reports and patches to Linux maintainers and routed other reports through Patch the Planet partners.
18 Those figures describe progress at that point in the disclosure process; they do not mean the remaining findings were all fixed or that every candidate patch was accepted.
What the announcement shows—and what it doesn’t
The result suggests that an AI-assisted workflow can combine large-scale code review with reproduction, exploit development, and candidate patch generation. The reported gap between 948 distinct flaws and the smaller number patched upstream after 10 days also underscores a practical limit: finding and validating vulnerabilities does not remove the time needed for review, coordination, and remediation.
The figures should be read as OpenAI’s account of a controlled research exercise, not as independently verified evidence that every reported exploit works across Linux systems or that the same results would follow in other environments. The announcement demonstrates a striking research capability; it does not establish that all 948 candidate fixes have been merged or deployed.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "OpenAI Reports 948 Linux Kernel Privilege-Escalation Flaws in One AI Pipeline Run"?
OpenAI says its prototype Linux security pipeline reproduced 1,724 vulnerabilities and generated candidate patches for 948 distinct privilege escalation flaws in one run, costing $1,213,430 in API credits.
What are the key points to validate first?
OpenAI says its prototype Linux security pipeline reproduced 1,724 vulnerabilities and generated candidate patches for 948 distinct privilege escalation flaws in one run, costing $1,213,430 in API credits. The pipeline moved from 2,308 candidate findings to 1,724 reproduced vulnerabilities, then to 948 distinct local privilege escalation flaws.
What should I do next in practice?
After 10 days, reporting put 61 flaws as patched upstream, 43 with staging patches, and 299 under public discussion—evidence that remediation takes longer than discovery.