OpenAI Built 948 Linux Root Exploits at $1,279 Each

OpenAI has put a price on breaking into Linux, and the price is low enough to change how every operator of a Linux system should think about patching. In a mid-October run disclosed on November 4, an automated pipeline powered by the model OpenAI launched a day later as GPT-6 Cyber produced working exploits for 948 distinct Linux kernel flaws that let an ordinary local user take full control of a stock desktop distribution. The run cost $1,213,430 in API credits, or $1,279 per flaw, against historical competition bounties of $20,000 to $70,000 for a single exploit of that kind.

GPT-6 Cyber turned 2,308 Linux findings into 948 patched root exploits

The pipeline ran in five stages with a human only at the end. Scout agents picked 5,034 audit targets, about 2.8 million lines or 7% of the kernel, that low-privileged users can reach. Analyst agents produced 2,308 candidate findings in 12 hours, triage agents reproduced 1,724 of them inside instrumented virtual machines within 30 hours, and exploit agents working against standard kernel protections such as KASLR, SMEP and SMAP produced 1,169 working privilege escalation exploits. After variant analysis, OpenAI counted 948 unique flaws and wrote a candidate patch for each. Following the kernel community's guidance, it has so far sent 304 critical findings to maintainers.

The model launch on November 5 put a name to the "upcoming cyber model" in that report. GPT-6 Cyber scores 48.5% on ExploitGym against 32.1% for GPT-5.6 Cyber, and found 81 previously unknown high-severity Firefox vulnerabilities in a codebase Mozilla's Brian Grinstead called "one of the world's most hardened and scrutinized codebases." OpenAI classifies it as Critical in cybersecurity, one step above its predecessor's High rating.

The cost of a root exploit fell 59% in three months

The comparison that matters most sits in OpenAI's own technical write-up. Two runs against the latest kernel, same harness, three months apart, produced very different economics.

The kernel had three more months of hardening before the second scan, and the newer model still found more than five times as many exploitable flaws at well under half the unit cost. OpenAI also reports that successful exploit attempts averaged $359 each once a candidate reached that stage, that its agents used at least 10 exploitation techniques that outside kernel experts had not seen before, and that a separate run against Google's hardened kernelCTF target produced 21 root exploits for $32,936, work that would earn about $1.5 million if the program accepted it.

A cheap exploit makes every unpatched account a root account

The most consequential sentence in OpenAI's report is a recommendation to defenders. For the near and medium term, the company writes, a low-privileged account on a system that lacks its latest patches should be considered functionally equivalent to root for a well-resourced attacker.

"functionally equivalent to root access for a well-resourced threat actor"

OpenAI, in A thousand fewer paths to root, November 4, 2026

Local privilege escalation still requires a foothold, such as a phished login, a compromised container or a malicious package, so these 948 flaws come into play once an attacker already has a way in. What changes is the cost of everything after that foothold. Security teams have long treated privilege escalation as the expensive second step that buys time to detect an intrusion. At $1,279 per working exploit, that second step becomes a routine purchase for any group that can match OpenAI's capability, and the window between a public kernel patch and its reverse-engineered exploit narrows for everyone running older kernels. Linux maintainers are already absorbing the volume: within 10 days of the scan, OpenAI counted 61 of the flaws patched upstream, 43 with staging patches and 299 under public discussion.

The report also carries a warning about the agents themselves. In an early run, 20 of 200 reported root exploits had reached root through a different zero-day than the one the agent was assigned, which forced OpenAI to add an independent check on the path to each result. GPT-6 Cyber's launch post leans on the same theme, reporting that the model avoided out-of-scope targets in 99.93% of honeypot tests without safety prompts. For enterprises deploying AI agents of their own, the lesson carries over directly: verify how an agent reached its outcome as well as the outcome itself.

Defenders will compete on patch latency and isolation

OpenAI is betting that putting this capability in defenders' hands first, through its gated Daybreak Red program, its $1 billion Frontline Defenders grants and automated patch generation, outruns attackers who will build similar pipelines on open or stolen models. That bet depends on patches actually shipping. Distribution maintainers, cloud providers and device makers whose kernels lag upstream by months carry the exposure, and OpenAI itself points to sandboxing tools such as Firecracker and gVisor as the practical limit on the damage. Santage has tracked the same pattern in browsers and web software, from XBOW's $250,000 Chrome exploit to the PHP2Shell exploit that arrived before its patch.

OpenAI's numbers show a model that can find and weaponize more kernel flaws in one autumn run than competition programs have rewarded in years, for about the price of a used car per exploit. The organizations exposed by that shift are the ones still running last quarter's kernel, and from November 5 onward their patch cycle is part of their attack surface.