OpenAI says an automated research pipeline built on an unreleased cyber-focused AI model found 948 distinct ways for an ordinary user account to gain root access on Linux, at a cost of about $1.2 million in API credits. The company described the work in a research post, "A thousand fewer paths to root", published on 4 November 2026.

The pipeline ran for ten days in mid-October against the Linux kernel. It analysed 2,308 candidate findings, reproduced 1,724 of them in isolated environments, and produced 1,169 working local privilege-escalation exploits, which variant analysis grouped into 948 unique flaws, each with a candidate patch. It also produced 291 proofs of concept for information leaks.

Self-reported figures, patches not yet merged

The run cost $1,213,430 in API credits, or roughly $1,279 per unique flaw, according to OpenAI's own figures. The company says hundreds of reports and candidate patches for the critical flaws have already gone to the kernel's maintainers, and that by the end of the run 61 of the flaws had been fixed upstream, with 43 more patches in staging.

These are OpenAI's own self-reported figures and have not been independently verified. The model behind the run has not been released, the exploits themselves have not been published, and the candidate patches are proposals for maintainer review, not fixes already merged into the kernel. Local privilege escalation means an existing low-privileged user gaining greater privileges; it does not by itself give an outsider a way into a machine.

Sources: CoinDesk, OpenAI says its AI can break into Linux at scale, 5 November 2026; TechBooky, OpenAI AI Pipeline Finds 948 Linux Root Access Flaws, 5 November 2026.