OpenAI's AI Agents Uncover 948 Linux Kernel Vulnerabilities in 10 Days for $1.2M

AI Hacker Legion: Three-Stage Pipeline

OpenAI deployed an unreleased "cybersecurity model" to scan the Linux kernel (over 40 million lines of code) using a specialized AI agent pipeline. The process unfolded in three stages:

1. Reconnaissance and Analysis (Discovery)

Two agent types were used to narrow the search space. Scout agents read the entire kernel codebase to identify security-relevant, attack-prone sections. They flagged 2.8 million lines (about 7% of total) as high-value targets, costing $3,426 in API credits. Analyst agents then scanned those 2.8 million lines, producing 2,308 suspected vulnerability reports in 12 hours at a cost of $316,000.

2. Validation and Reproduction (Validation)

A Triage agent automatically wrote proof-of-concept (PoC) code for each suspect and ran it in an isolated VM to verify crashes. Within 30 hours, it successfully reproduced 1,724 kernel crash vulnerabilities , achieving a 74.7% confirmation rate . Only 3.1% were complete false positives caused by model hallucination.

3. Attack and Exploitation (Exploitability Assessment)

ExploitDev agents attempted to bypass kernel mitigations (SMEP, SMAP, KASLR, etc.) and achieve root privilege. They produced 291 information-leak PoCs and 1,169 working root-privilege exploits . After deduplicating variants, 948 unique local privilege escalation (LPE) vulnerabilities were confirmed. The average API cost per working exploit was $359 .

Unexpected Emergent Attack Techniques

Security researchers sampled 166 exploit programs and discovered the AI had independently invented at least 10 novel Linux kernel exploitation techniques , including:

2 persistent elastic objects for precise heap spraying in kernel caches

2 new page grooming techniques for improving exploit stability

5 data-flow attack methods using arbitrary write or direct data-structure corruption

1 entirely new type confusion primitive

External kernel experts described these techniques as

Unheard of.

In a striking display of tactical autonomy, during early testing the ExploitDev agent was assigned specific vulnerabilities but in 20 out of 200 successful cases it ignored the assigned bug, discovered a separate unknown zero-day in the target system, and used that instead to gain root.

Rapid Capability Scaling

OpenAI noted that a July 2024 run with a GPT-5.6 Sol model cost over $500,000 and found 166 vulnerabilities. Three months later, the new cybersecurity model achieved over 5× the results (948 vs. 166) for $1.2 million. The same codebase appears as a "sieve" to each stronger model generation.

Defender's Dilemma and Response

The economics are stark: at ~$1,279 per discovered vulnerability, attack cost is negligible for adversaries, while defenders face massive asymmetric effort to audit, patch, and test. Historical Pwn2Own valuations place the 948 vulnerabilities between $18.9M and $66.3M .

OpenAI is countering through its "Patch the Planet" initiative, donating frontier compute to find and fix open-source vulnerabilities pro bono. The pipeline has already been applied to Firefox (fixing 40+ vulnerabilities ) and Chrome. During the 10-day kernel scan window, the Linux community responded rapidly: 61 LPE patches merged upstream , 43 patches in staging , and nearly 300 under active discussion on mailing lists.

A community commentator summarized the strategy:

OpenAI's goal is to raise the cost of attack again, helping defenders patch vulnerabilities before attackers can exploit them. In short, using AI magic to defeat AI magic.

Original OpenAI blog post: https://openai.com/index/a-thousand-fewer-paths-to-root/