OpenAI pipeline reproduces 1,724 Linux kernel vulnerabilities and builds 948 root exploits

From single investigations to a systematic process

According to OpenAI, security research that once needed a separate, sustained investigation for each finding can increasingly be run as a systematic process. The company argues that vulnerability discovery is getting easier to scale, while prioritization and validation remain operational bottlenecks.

The new work builds on a June announcement under OpenAI's Patch the Planet initiative, in which GPT-5.5 Cyber identified Linux kernel vulnerabilities and developed 24 local privilege escalation exploits to validate and report them. OpenAI has now expanded that effort into a pipeline covering vulnerability discovery, dynamic validation, exploitability assessment and patch generation. Human researchers reviewed the outputs and reported the vulnerabilities together with patches. Following guidance from the Linux kernel community, OpenAI began with critical vulnerabilities and is working with Patch the Planet partners on further reports and patches.

OpenAI chose the Linux kernel because it underpins Android devices, cloud infrastructure and supercomputers, and contains more than 40 million lines of code. Its system calls, networking, filesystems and device drivers form a broad attack surface.

Five stages, with humans at the end

The prototype has five stages: vulnerability discovery, dynamic validation, exploitability assessment, patch generation and human review. At the end, the system bundles a root cause analysis, a minimal crashing proof-of-concept, a candidate patch and a full exploit, so that researchers can judge severity and send fixes upstream.

Discovery starts with Scout agents, which read through folders and files and pick audit targets based on reachability by low-privileged users and security relevance. They identified 5,034 audit targets, about 2.8 million lines of code or roughly 7% of the kernel code base, at a cost of $3,426 in API credits. Analyst agents then examined each target, using a workflow similar to the Codex Security plugin. Within 12 hours they produced 2,308 candidate findings after deduplication, at a cost of $316,549.

Validation: 1,724 reproduced bugs

OpenAI stresses that a candidate finding is not a validated vulnerability. Its triage agent generated a proof of concept for each candidate and ran it in an isolated virtual machine with a Linux kernel using Kernel Address Sanitizer (KASAN). The agent refined the proof of concept until it reproduced the reported behavior or ran out of ways to trigger it.

Within 30 hours the system reproduced 1,724 vulnerabilities, about 74.7% of the 2,308 candidates. OpenAI says it was impressed by the accuracy of the analyst agents, given that static code review alone tends to produce false positives. Most of the remaining findings either required elevated privileges or did not reproduce within the time budget, owing to difficult race conditions, specific trigger conditions or time-consuming validation. Only 3.1% reflected incorrect analysis by the model, where the reported bug assumed an impossible condition. Validation cost $73,330 in API credits.

OpenAI also notes that validating a true positive and a false positive cost a similar amount, and that generating a proof of concept was more expensive than a recommendation based on static analysis alone. Removing false positives earlier therefore makes the process meaningfully more cost-efficient.

Exploitability: from 1,724 bugs to 948 root paths

Because validation shows that a bug is real but not how urgent it is, a screening agent reviewed each report, crash log and the relevant source statically. It was deliberately permissive. This narrowed the set to 313 information leak candidates and 1,238 local privilege escalation candidates.

ExploitDev agents then tested these in isolated virtual machines configured with protections found in a standard Linux distribution, including SMEP, SMAP, KASLR and HARDENED_USERCOPY. OpenAI says this avoided unrealistic assessments that relied on protections being switched off. The agents produced 291 proofs of concept for information leaks and 1,169 working local privilege escalation exploits. After variant analysis, OpenAI developed 948 distinct patches for the vulnerabilities behind those exploits and uses that figure as the count of unique local privilege escalations. Successful exploits cost an average of $359 in credits to develop.

What it means for defenders

OpenAI describes the mission of its Cyber team as helping secure the software the world relies on, with the goal of helping defenders find and fix vulnerabilities, reduce opportunities for attackers and raise their cost of exploiting software. The company reports API costs for each stage so that other researchers can estimate the resources needed to reproduce and extend the work.

It cautions that the research focused on methodology and measuring model capability, not cost. In its view, sufficient harness engineering could meaningfully reduce the cost at each stage, so the published figures are more of an upper bound. The company's own conclusion is that the hard part at this scale is no longer finding candidate bugs but determining which ones can be reproduced, what security boundary they cross and which deserve maintainers' attention first.