OpenAI says its AI found 948 Linux flaws that grant full control

It took just twelve hours. In mid-October, OpenAI's artificial intelligence agents flagged 2,308 possible flaws in the Linux kernel, the core of the system that powers much of the world's servers, in less than half a day. In under thirty hours, they reproduced 1,724 of them in isolated virtual machines.

OpenAI described the experiment on November 4 in a research report titled “A thousand fewer paths to root.” According to the company, its prototype produced 1,169 working attack programs that let an ordinary user become the administrator (“root”) of the machine. Once variants were grouped together, 948 distinct flaws remain, counted by the patch that closes each one. The bill came to $1,213,430 in model usage credits, or about $1,279 per flaw.

A specialized model that is not yet public

The work was handled by an upcoming cybersecurity-focused model that OpenAI does not name. The pipeline has five steps: discovery, reproduction, assessment of exploitability, writing a patch, then human review. “Scout” agents first narrowed the kernel's more than 40 million lines down to 5,034 areas to audit, or about 2.8 million lines.

The jump since summer is clear. In July, a first pass with GPT-5.6 Sol found 166 flaws of this type for $513,690. OpenAI attributes the difference to a more powerful model. The company also advises re-scanning already audited code as models improve: a more capable model may find flaws that earlier ones missed. On a sample of 166 attacks, its researchers say they identified ten techniques considered novel, including by outside experts they consulted. As a precaution, OpenAI is not publishing all the technical details.

How many of these flaws are already fixed?

A minority, for now. According to OpenAI, security researchers reviewed every attack, every patch and every proposed severity level before anything was reported. Critical flaws went first, as the kernel community recommends. At the end of the analysis, after ten days, 61 flaws were already fixed in the official kernel, 43 had a patch being merged, and 299 had been reported or publicly discussed. The rest were waiting their turn. Reports continue under Patch the Planet, OpenAI's program dedicated to open-source software security.

OpenAI also calculates what these flaws would have earned in hacking contests: between $18.9 million and $66.3 million. The company itself presents this figure as theoretical.

What should you do on your Linux servers?

These flaws cannot be exploited directly from the internet. The attacker must already be able to run code on the machine, through a stolen account, a compromised application or a container. They serve to turn limited access into full control. Good practices:

• install your distribution's kernel updates as soon as they are released and plan for reboots: more than a hundred patches are already published or in the works;
• limit the accounts and services that can run code on your servers, especially on shared machines;
• follow your distribution's security bulletins (Debian, Ubuntu, Red Hat, SUSE…);
• monitor for unusual account creations and privilege escalations.

What if attackers had the same tool?

The race began several months ago. In October, Tencent detailed a flaw giving full control of a Linux machine, discovered with the help of an AI. The company XBOW, for its part, built an attack chain against Chrome in six days using an OpenAI model. The specialist site Runtime Wire points out that in an attacker's hands, the same capability could shorten the time between a kernel change and a working attack. Human review and maintainers' control over patches become all the more important.

OpenAI says neither when its model will be released nor who will have access to it. It also remains to be seen how kernel maintainers will absorb hundreds of reports within a few weeks.

Update of November 12, 2026

The specialized model that OpenAI did not name in its Linux kernel report now has a name. On November 5, the day after the report, the company unveiled GPT-6 Cyber, to which BleepingComputer attributes the 948 flaws that let an attacker become administrator (“root”) of a Linux machine.

The model is not public. It is reserved for a small group of approved customers of Daybreak Red, OpenAI's offering for advanced exploit development and authorized security testing. The company plans to open it soon to all customers of that offering, without giving a date or a price.