OpenAI’s cyber model finds 948 Linux kernel privilege escalation flaws in research run

The pipeline—combining vulnerability discovery, exploit validation, patch generation, and human review—scanned 5,034 audit targets (about 2.8 million lines of code, or 7% of the kernel). Within 12 hours, analysts produced 2,308 deduplicated findings, of which 1,724 were dynamically validated in 30 hours. Only 3.1% of the remaining findings were false positives. The final exploit stage yielded 291 information-leak proofs and 1,169 working LPE exploits, with 948 distinct patches generated for maintainer review. OpenAI notes the 948 figure reflects unique vulnerabilities, not merged patches.

The research cost $1.213 million in API credits (or $1,279 per unique LPE), a fivefold increase in novel findings compared to a July 2026 test with GPT-5.6 Sol. OpenAI emphasizes the need for human verification to avoid redundant or obsolete reports, as automated patches may contain inefficiencies or coding deviations. The findings will be shared gradually via Patch the Planet partners, with critical flaws already reported to maintainers.