--- title: "948 Kernel Root Exploits for $1.2M in API Credits" pubDatetime: 2026-11-05T00:15:00.000Z description: "OpenAI's mid-October pipeline produced 1,169 working LPE exploit instances across 948 unique kernel findings; 61 had upstream patches ten days later." tags: [ai-security, vulnerability, openai, exploit-development, vulnerability-disclosure, ai-agents, cyber, 2026, 2026-q4, 2026-11] --- *Update, 7 November 2026: Clarified the difference between working exploit instances and unique LPEs, and added the report's stage-specific cost and complexity details. Original publication date remains 5 November.* > [!tldr] TL;DR > In its mid-October run, OpenAI's pipeline reproduced 1,724 of 2,308 candidate findings. It produced 1,169 working LPE exploit instances, which variant analysis grouped into 948 unique LPEs, plus 291 information-leak proofs of concept. The $1,213,430 API bill averages about $1,280 per unique LPE. Exploit-stage costs varied: successful attempts averaged about $360, while 69 failed attempts averaged $3,922 each, with difficult races among the expensive cases. Ten days later, 61 of the 948 unique LPEs had upstream patches and 43 more had patches in staging. Same kernel, same pipeline, three runs: 24 working root exploits in June, 166 in late July, 948 unique LPEs in mid-October. OpenAI published [the mid-October results on 4 November](https://openai.com/index/a-thousand-fewer-paths-to-root/). The growth curve belongs to the model, not the harness, and that is the most interesting number in the post. ## Pipeline: 2,308 candidates to 948 unique LPEs The five stages are discovery, dynamic validation in isolated VMs, exploitability assessment, patch generation, and human review before anything goes upstream. Discovery produced 2,308 candidates; dynamic validation reproduced 1,724, a 74.7% rate. ExploitDev produced 1,169 working LPE exploit instances from 1,238 LPE candidates, plus 291 information-leak PoCs from 313 candidates. Variant analysis grouped the LPE instances into 948 unique findings and patches. Total API spend: $1,213,430. Dividing by 948 unique LPEs gives about $1,280 in API credits per finding ($1,213,430 ÷ 948). That is an all-in pipeline average, not the exploit-development cost alone. In the exploit stage, an LPE candidate cost about $558 to process versus $271 for an information-leak candidate; OpenAI says LPE work needed strategy planning, vulnerable-object selection, and mitigation bypasses. The 69 unsuccessful exploit attempts averaged $3,922 each, about 11 times the $360 average for successful attempts. OpenAI attributes the expensive failures to hard cases such as race conditions. The report gives no per-finding cost distribution. OpenAI puts the hypothetical bounty value of the 948 findings at $18.9M to $66.3M using historical rates, which is 16x to 55x the pipeline cost. That comparison is the softest claim in the whole post. The $1.2M covers API credits and nothing else. Sandbox infrastructure, researcher review time, patch regression testing, disclosure coordination, and the cost of developing the cyber model itself all sit outside it. OpenAI acknowledges those costs exist without totalling them, and the bounty side is a counterfactual price for exploits nobody bought. ## Scaffolding stopped carrying the results The June baseline came from GPT-5.5-Cyber under [Patch the Planet](https://openai.com/index/patch-the-planet/), OpenAI's program with Trail of Bits and HackerOne, which scored 85.6% on CyberGym and turned up eight info-leak PoCs and 24 LPEs on the kernel. Late July, with GPT-5.6 Sol, the full pipeline found 166 unique LPEs. By [August, GPT-5.6-Cyber was credited](https://cybersecuritynews.com/openai-expands-daybreak-cyber/) with more than 400 kernel privilege-escalation issues. The scaffolding result is the sharp one. OpenAI hand-fed the pipeline 103 exploitation techniques. For the earlier model that was worth 12.7 points of success rate. For the newer cyber model it moved the needle 1.5 points. The expert knowledge a team spends weeks encoding is now mostly already in the weights, which makes the capability jump cheaper to reproduce than the engineering around it suggests. From the mid-October results, [OpenAI sampled 166 working exploits](https://openai.com/index/a-thousand-fewer-paths-to-root/) and reports 10 novel techniques: two persistent elastic-object approaches, two page-grooming methods, five data-only techniques, and one arbitrary type-confusion method. It says third-party kernel experts also found them novel, but withholds full technical details. OpenAI also reports a QEMU TCG vulnerability found during the run; that remains its own account pending independent confirmation. ## 20 of 200 exploits rooted the wrong bug Buried in the post is the best data point for anyone who reads "AI found an exploit" headlines. During early testing, 20 of 200 reported successful exploits had achieved root through a 0-day other than the one assigned to them. The agent got a root shell, reported success, and was wrong about why. OpenAI added independent re-verification to catch it. A one-in-10 misattribution rate on self-reported exploit success is worth carrying to every similar claim, including ones we have covered from [Anthropic](/posts/auto-claude-openai-exploit) and [open-weight cyber models](/posts/cyberkimi-v8-exploit-claim). Validation stages are the difference between 948 exploits and 948 claims. ## After 10 days: 61 patched upstream OpenAI's own status check, 10 days after the run, counts 61 of the 948 vulnerabilities patched upstream, 43 with patches in staging, and 299 under public discussion. That is 6.4% fixed, about 11% with a fix in motion, and roughly 57% with no tracked status at all. OpenAI frames this as the reason automated triage needs continuous rescanning against current code rather than as a solved problem, which is the honest read. It is also the same ratio this blog keeps finding. Anthropic's Glasswing program [disclosed 1,129 findings against 75 shipped patches](/posts/discovery-outran-remediation), and its CVD program plus DARPA's AI Cyber Challenge [landed at 16:1 discovery-to-fix](/posts/auto-vulnerability-patch-gap). Three programs, the same shape of result. Kernel maintainers reviewing AI-generated patches are the bottleneck, and additional discovery capacity does nothing for them. Nor do 948 point fixes say much about why the kernel offers thousands of distinct root paths in the first place. One Hacker News commenter wants a breakdown of the deficiency categories behind these bugs, which OpenAI's post does not provide. OpenAI says it will keep rescanning the kernel against the latest code. --- *Sources: [A thousand fewer paths to root](https://openai.com/index/a-thousand-fewer-paths-to-root/) • [Patch the Planet](https://openai.com/index/patch-the-planet/) • [OpenAI expands Daybreak Cyber](https://cybersecuritynews.com/openai-expands-daybreak-cyber/)* *Coverage: [OpenAI Pipeline Identifies 948 Linux Kernel Vulnerabilities](https://blockchain.news/news/openai-pipeline-linux-kernel-vulnerabilities) • [OpenAI's AI Reproduced 1,724 Linux Kernel Flaws in $1.2M Run](https://fourweekmba.com/ai-openais-ai-reproduced-1724-linux-kernel-flaws-in-1-2m-run/) • [Hacker News discussion](https://news.ycombinator.com/item?id=50372929)* *Related on this blog: [[AUTO] GPT-5.6-Cyber: OpenAI's Exploit Development Model](/posts/auto-daybreak-cyber) • [Finding Bugs Got Cheap. Fixing Them Didn't.](/posts/discovery-outran-remediation) • [[AUTO] Commodity AI Agents Are Now Attacker Infrastructure](/posts/auto-artex-commodity)*