MAG212 CYBER ORIGINAL ARTICLE

OpenAI’s “A Thousand Fewer Paths to Root”: AI Agents Built 1,169 Linux Kernel Root Exploits

November 6, 2026 · El Mostafa Ouchen

MAG212 CYBER | Security Research | November 6, 2026

OpenAI says AI agents running an unreleased “upcoming cyber model” found enough Linux kernel flaws in one October run to produce 1,169 working local privilege escalation (LPE) exploits, which it mapped to 948 separate proposed patches, for about $1.21 million in API credits. Within ten days, 61 of the bugs were patched upstream and 43 more had patches in staging. The research, titled “A thousand fewer paths to root”, is one of the clearest signs yet of how quickly AI can turn kernel code into working exploits.

A note on sourcing. OpenAI’s original post could not be retrieved for this article. All figures below are as reported by SecurityWeek, Help Net Security, Unite.AI and TechRadar, which summarise the post and agree on the numbers.

Key facts

Item	Detail
Source	OpenAI, “A thousand fewer paths to root” (dated 4 November 2026 by Unite.AI), via secondary reporting
Model	An unnamed, unreleased “upcoming cyber model”
Target	Latest Linux kernel master branch, mid-October 2026; stock desktop distribution with KASLR, SMEP and SMAP enabled
Candidates	2,308 deduplicated; 1,724 reproduced (74.7%)
Output	1,169 working LPE exploits and 291 information-leak proofs of concept
Unique fixes	948 proposed patches (used as the unique-LPE count)
Cost	$1,213,430 in API credits, roughly $1,279 per LPE (upper bound)
10-day status	61 patched upstream, 43 with staging patches
CVEs	None reported in coverage

How the pipeline worked

According to Unite.AI and Help Net Security, “scout” agents first chose 5,034 audit targets, about 2.8 million lines of code, or roughly 7% of the kernel reachable by low-privileged users. They produced 2,308 deduplicated candidate bugs in 12 hours. Dynamic validation then reproduced 1,724 of them in 30 hours.

From those, the pipeline built 1,169 working LPE exploits and 291 information-leak PoCs. Test machines ran an unmodified desktop Linux distribution with KASLR, SMEP and SMAP enabled, according to SecurityWeek, and Unite.AI adds HARDENED_USERCOPY. Unite.AI reports that 3.1% of findings reflected incorrect model analysis.

OpenAI also described a validation problem. Help Net Security reports that in an early run, 20 of 200 claimed exploits reached root through a different zero-day than the one they were assigned. OpenAI then added an independent check that each exploit uses its intended bug.

What “948” does and doesn’t mean

The headline number needs care.

948 is a count of proposed patches, written by OpenAI for the underlying bugs and used as the unique-LPE count. Unite.AI notes that it does not count merged fixes. It is not “948 bugs fixed”.
Only 104 had moved into the fix pipeline after ten days: 61 patched upstream and 43 with staging patches, the “100+” figure in some coverage. TechRadar and Help Net Security also report 299 publicly reported or discussed.
It is not 948 CVEs. No coverage reports CVE identifiers for these bugs.
These are local escalations. An LPE lets someone who already runs code on a machine, for example through a low-privileged account, a compromised service or a container, become root. It is not a way to break in remotely.

Cost, comparison and value

OpenAI’s reported cost was $1,213,430 in API credits, roughly $1,279 per LPE, and the company says the costs are upper bounds. SecurityWeek reports that an earlier late-July run with GPT-5.6 Sol found 166 unique LPEs for $513,690. OpenAI says the October run found more than five times as many new LPEs despite three months of kernel hardening in between.

In a sample of 166 exploits, OpenAI reported “at least 10 novel Linux exploitation techniques” that outside kernel experts also did not know. Details are withheld.

Two value estimates appear in coverage, and both are hypothetical. An adapted run against Google’s kernelCTF took 112 hours, cost $32,936 and produced 21 LPEs and 25 info-leak PoCs, with a bounty value of about $1.5 million if accepted. SecurityWeek reports a market-value estimate of $18.9 million to $66.3 million, based on $20,000 to $70,000 payouts at Pwn2Own and TyphoonPWN.

How OpenAI is disclosing the bugs

Coverage says OpenAI security researchers reviewed every exploit, patch and proposed severity before reporting. OpenAI has sent “hundreds” of reports and patches, prioritising the most critical flaws on the kernel community’s advice. The remainder are being disclosed in stages through Patch the Planet, which Unite.AI describes as a Daybreak initiative with Trail of Bits launched on 22 June 2026. Maintainers keep control of patch deployment and disclosure.

Full technical details have been withheld for safety, and no coverage reports any exploit release.

The missing voice: kernel maintainers

We found no public reaction from Greg Kroah-Hartman, the Linux kernel CNA or other maintainers. Searches for LWN, The Register and kernel mailing-list coverage returned nothing relevant, and Help Net Security explicitly notes the absence. TechRadar’s author says the report reads partly like marketing for OpenAI’s cyber model, but argues the results should not be ignored.

In our assessment, because the kernel CNA assigns CVEs to fixed bugs, distributions could face a large wave of kernel fixes, and possibly CVEs, over the coming weeks as patches land. No source confirms that volume yet.

Why it matters

OpenAI’s sharpest claim, as reported by SecurityWeek and Help Net Security, is that in the near and medium term an unpatched low-privileged account “should be considered functionally equivalent to root access for a well-resourced threat actor.” Help Net Security adds that OpenAI expects frontier models to find vulnerabilities in software projects within a few years, and less capable models to be able to build exploits once issues are disclosed.

That shortens the window between a kernel fix appearing and someone exploiting the bug.

What Linux administrators should do

Tighten kernel patch cadence. Expect a steady flow of kernel updates from your distribution and plan reboots or live patching to match. A fix that is merged but not deployed protects no one.
Know what you are running. Build an inventory of kernel versions across servers, VMs, CI runners and appliances, and compare it with your vendor’s current release, using uname -r (example below).
Treat low-privileged access as serious. Following OpenAI’s framing, assume any unpatched account, web shell or compromised service account could become root. Review shell access, remove stale accounts and alert on unexpected logins.
Isolate untrusted workloads. OpenAI recommends layered defences and sandboxing or isolation such as Firecracker and gVisor. In our view, start with code you don’t fully trust, such as multi-tenant jobs and build pipelines.
Watch your distribution’s advisories, not just upstream. Staging and upstream patches only help once your vendor ships them.

A quick kernel inventory to start with:

# per host
uname -r
# across a fleet (example with SSH)
for h in $(cat hosts.txt); do echo "$h $(ssh "$h" uname -r)"; done

Frequently asked questions

Did OpenAI fix 948 Linux kernel bugs?

No. 948 is the number of proposed patches OpenAI wrote. After ten days, 61 were patched upstream and 43 had staging patches, according to coverage of OpenAI’s post.

Can these bugs be exploited remotely?

They are local privilege escalation bugs. An attacker needs to run code on the machine first, but OpenAI says an unpatched low-privileged account should be treated as roughly equivalent to root for a well-resourced attacker.

Has OpenAI released the exploits?

No coverage reports any exploit release. OpenAI withheld technical details and is disclosing through Patch the Planet, with maintainers controlling deployment.

Are there CVEs for these Linux kernel flaws?

None appear in the coverage reviewed. Watch your distribution’s kernel advisories as fixes land.

Sources

This article expands a story from the MAG212 CYBER Daily, 6 November 2026.

Read the full magazine (PDF) →