OpenAI's autonomous pipeline patches 948 Linux kernel privilege-escalation bugs

OpenAI says its security researchers built an autonomous pipeline that handles vulnerability discovery, exploitation and patching. In one run using an upcoming cyber model, the pipeline validated and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel. The company gives a total API cost of $1.2 million for that run.

OpenAI says the agents used at least 10 Linux exploitation techniques that its team and consulted experts consider novel, which it presents as evidence that models can go beyond applying known methods. Eric Wallace says researchers typically find about 20 Linux privilege-escalation bugs a year, and that the model found about 1,000 in one week. Greg Brockman cites roughly $1,000 per vulnerability.

OpenAI says it is working with Linux maintainers and Patch the Planet partners on reports and patches. Wallace also says the company is putting a significant amount of frontier compute toward pro bono open-source patching. The run used an unreleased model, separate from the GPT-6.2 Sol and Astra models that were rumored in the same roundup.

Developers building agents that run code or hold shell access on Linux hosts should note how cheaply autonomous vulnerability discovery and exploitation are now reported to run, and plan their threat models accordingly.

Maintainers and teams running Linux in production may see a rising volume of kernel patches, so keeping kernels and agent sandboxes current becomes more important.

The cost figures are OpenAI's own API-based numbers and have not been independently verified, so treat them as reported rather than confirmed.