OpenAI has shown that an AI system can now find and weaponise Linux kernel bugs faster than people can fix them. Its security team ran a research pipeline, built around an unreleased cyber model, over the parts of the kernel an ordinary user can reach, and came back with 948 distinct ways to turn a normal account into root. Anyone who runs Linux servers, Android phones or cloud machines sits downstream of that result, which is why the patches matter more than the headline number.
The pipeline has five stages. Scout agents picked 5,034 audit targets, about 7% of a kernel of more than 40 million lines, for $3,426. Analyst agents then spent 12 hours and $316,549 producing 2,308 candidate bugs. Triage agents reproduced 1,724 of them in virtual machines within 30 hours, and OpenAI says only 3.1% of the candidates rested on faulty reasoning by the model. Exploit agents, working against a standard desktop configuration with the usual kernel protections switched on, produced 1,169 working root exploits, which variant analysis reduced to 948 separate flaws. The whole October run cost $1,213,430 in API credits; a successful exploit averaged about $359.
The comparison with July is the sharper signal. GPT-5.6 Sol, run through an earlier version of the same pipeline, found 166 such flaws. The newer model found more than five times as many three months later, and OpenAI reports it also used 10 exploitation techniques that outside kernel experts had not seen. OpenAI's own maths puts the pipeline in profit against historical bug bounty prices, which is a warning as much as a boast: the same economics apply to attackers. We review the restricted version of this capability as GPT-6 Cyber, which OpenAI sells only to vetted defenders.
The response so far looks encouraging. After 10 days, 61 of the root flaws had fixes merged upstream, 43 had patches in staging and 299 were under public discussion, and OpenAI says it is sending the rest through its Patch the Planet partners. That leaves hundreds of known holes still to be handled by volunteer and company maintainers whose numbers have not grown with the models.
There are limits to what outsiders can check. OpenAI chose which figures to publish, withheld the new techniques for safety reasons, and has not named the model. Its machine-written patches needed extra rounds of prompting to stop them being bloated or incomplete, and in one early run 20 of 200 reported exploits had reached root through a different bug than the one assigned. The cost figures are an upper bound, by OpenAI's own account, so the price of doing this will only fall.