analyst@unixshadow:~$ cat openai-pipeline.log # 948 ways to root, in one run
948 Root Bugs in One Run
What OpenAI’s Kernel Vulnerability Pipeline Means for Linux
On November 4, 2026, OpenAI published “A thousand fewer paths to root”: the results of pointing an autonomous multi-agent pipeline at the Linux kernel for ten days in mid-October. It found 948 distinct local privilege escalation flaws, wrote a working exploit for each one, and drafted a patch for each. The bill was $1,213,430 in API credits — about $1,279 per root bug. This is not a story about a single vulnerability. It is a story about what vulnerability discovery costs now, and what that does to everyone who runs Linux.
# the run, stage by stage — the numbers are OpenAI’s own, and they say so
Scope: 5,034 audit targets covering about 2.8 million lines of kernel code reachable by low-privileged users — roughly 7% of the kernel. The targets were the code an ordinary user account can reach, not the whole tree.
Candidates: 2,308 flagged by the discovery agents.
Reproduced: 1,724 confirmed in isolated virtual machines running KASAN, with the defences of a standard Linux distribution enabled (SMEP, SMAP, KASLR, HARDENED_USERCOPY). About 74.7% of candidates reproduced — the pipeline’s own filter, not a human’s.
Exploits: 1,169 working local privilege escalation exploits — each one taking an ordinary user account to root — plus 291 separate information-leak proofs of concept, a less severe class of bug.
Distinct flaws: 948, after grouping exploits that shared a root cause. Each one comes with a pipeline-generated candidate patch.
Cost: $1,213,430 in API credits for the whole run, or about $1,279 per distinct flaw. That is API spend at OpenAI’s internal rates, not cash paid to anyone, and it does not include the human labour of triage and review.
Fix status, ten days after the scan: 61 flaws patched upstream, 43 with staging patches, 299 being reported and discussed publicly. The rest were still working through the pipeline. A generated patch is not a deployed fix, and 948 candidate patches do not mean 948 fixed kernels.
Candidates: 2,308 flagged by the discovery agents.
Reproduced: 1,724 confirmed in isolated virtual machines running KASAN, with the defences of a standard Linux distribution enabled (SMEP, SMAP, KASLR, HARDENED_USERCOPY). About 74.7% of candidates reproduced — the pipeline’s own filter, not a human’s.
Exploits: 1,169 working local privilege escalation exploits — each one taking an ordinary user account to root — plus 291 separate information-leak proofs of concept, a less severe class of bug.
Distinct flaws: 948, after grouping exploits that shared a root cause. Each one comes with a pipeline-generated candidate patch.
Cost: $1,213,430 in API credits for the whole run, or about $1,279 per distinct flaw. That is API spend at OpenAI’s internal rates, not cash paid to anyone, and it does not include the human labour of triage and review.
Fix status, ten days after the scan: 61 flaws patched upstream, 43 with staging patches, 299 being reported and discussed publicly. The rest were still working through the pipeline. A generated patch is not a deployed fix, and 948 candidate patches do not mean 948 fixed kernels.
Read the funnel, not the headline. 2,308 candidates became 948 distinct flaws — the pipeline’s value is not that it found a lot, it is that it proved which ones were real, with a working exploit each time.
# what the model is, and what it is not — GPT-6 Cyber, Critical-rated, and you cannot sign up for it
The day after the kernel results, November 5, OpenAI named the model: GPT-6 Cyber, a security-tuned variant of GPT-6 Astra built for vulnerability discovery, exploit development, and web penetration testing. Under OpenAI’s own Preparedness Framework it is rated Critical for cybersecurity — the top tier. The first users are a select group of approved Daybreak Red customers, through the API and Codex. There is no public signup and no published price.
OpenAI also says the pipeline found 10 exploitation techniques it believes are new, sampled from 166 of the exploits, and it is withholding the details of those techniques for safety reasons. The exploit code itself has not been released.
And the honest split: every figure in this post is OpenAI-reported. There has been no independent replication of the run and no independent audit of all 948 patches. OpenAI’s own write-up stresses that candidate findings are not the same as validated vulnerabilities — the 1,169 working exploits are the validation, and that is the part worth trusting. The 20-of-200 early-run detail is worth keeping too: in the initial runs, 20 of 200 exploits judged successful had reached root through a different zero-day than the one they were aimed at, which is why the pipeline validates each exploit against its intended target rather than counting a root shell as a pass.
OpenAI also says the pipeline found 10 exploitation techniques it believes are new, sampled from 166 of the exploits, and it is withholding the details of those techniques for safety reasons. The exploit code itself has not been released.
And the honest split: every figure in this post is OpenAI-reported. There has been no independent replication of the run and no independent audit of all 948 patches. OpenAI’s own write-up stresses that candidate findings are not the same as validated vulnerabilities — the 1,169 working exploits are the validation, and that is the part worth trusting. The 20-of-200 early-run detail is worth keeping too: in the initial runs, 20 of 200 exploits judged successful had reached root through a different zero-day than the one they were aimed at, which is why the pipeline validates each exploit against its intended target rather than counting a root shell as a pass.
# the other side of the ledger — Anthropic’s dashboard, snapshotted November 2
Anthropic runs the same idea at a different scale. Its coordinated vulnerability disclosure dashboard, snapshotted November 2, 2026, shows 37,966 candidate findings from Claude models (including an early snapshot of Claude Mythos Preview) across open-source software. Of those: 6,376 triaged, 6,009 reviewed by external security firms at a 94.2% true-positive rate, 5,087 disclosed across 680 open-source projects, 629 patched upstream, 733 identifiers assigned (230 of them CVEs). Anthropic also reports 3,225 findings sent directly to maintainers without the independent check.
The dashboard’s own words are the point: “the process of independent human triage and review is the rate limiting step,” and confirmed bugs exist “that we have not yet reported to maintainers, due to capacity limitations.” Finding is cheap now. Triage is not.
The same organisation is behind the CVE that mattered most to this site’s readers last month. Anthropic’s researcher Xinyang Ge is credited in the fix for CVE-2026-98432, the Linux kernel IPv4 TCP handshake use-after-free (CVSS 9.8) that this site’s own box was patched for on November 3. Anthropic published research on October 27 describing an exploit its model wrote for one configuration — a server with a Multipath TCP listener — reaching root in about 53 minutes: 48 to leak a kernel address, about 5 more to run commands as root. The exploit code was not released, and no attacks in the wild had been reported as of early November.
The dashboard’s own words are the point: “the process of independent human triage and review is the rate limiting step,” and confirmed bugs exist “that we have not yet reported to maintainers, due to capacity limitations.” Finding is cheap now. Triage is not.
The same organisation is behind the CVE that mattered most to this site’s readers last month. Anthropic’s researcher Xinyang Ge is credited in the fix for CVE-2026-98432, the Linux kernel IPv4 TCP handshake use-after-free (CVSS 9.8) that this site’s own box was patched for on November 3. Anthropic published research on October 27 describing an exploit its model wrote for one configuration — a server with a Multipath TCP listener — reaching root in about 53 minutes: 48 to leak a kernel address, about 5 more to run commands as root. The exploit code was not released, and no attacks in the wild had been reported as of early November.
# what this means if you run Linux — the practical part
These are local bugs, not remote ones. Every one of the 948 needs a foothold first — an ordinary user account on the box. On its own, none of them lets an attacker in from the network. What they change is what a foothold is worth: OpenAI’s own phrasing is that a low-privileged account on an OS that is not on its latest patches “should be considered functionally equivalent to root access for a well-resourced threat actor.” The boundary between “unprivileged user” and “root” is now a patch window, not a privilege boundary.
You cannot check whether your kernel is affected. OpenAI has published no CVE list and no breakdown by subsystem, so there is no version number to compare against and no list to grep. The only honest answer to “am I affected?” is the one that was always true: keep the kernel patched and reboot after patching, because a kernel update that is not booted is not a fix. The 61-of-948 patched figure is the other side of that: most of these flaws are still working through the reporting pipeline, and they will land as ordinary kernel updates over the coming months, not as one dramatic patch day.
Patch cadence is the defence, and it was already the defence. Nothing in this story changes what a sysadmin does on Monday morning — it changes how much slack there is in doing it late. A kernel that is three months behind was always a risk; it is now a risk with 948 more known paths behind it, and the cost of finding the next 948 just fell to about $1,279 each.
And the container angle, since it is the one people get wrong: a container escape is not what these bugs are, but a local privilege escalation inside a container that reaches the host kernel is the same bug wearing a different hat. The host kernel is the boundary. Patch the host, reboot the host, and a container-level fix is not a substitute — the same lesson as CVE-2026-98432, where the fix was a host kernel update and a reboot, not a container change.
You cannot check whether your kernel is affected. OpenAI has published no CVE list and no breakdown by subsystem, so there is no version number to compare against and no list to grep. The only honest answer to “am I affected?” is the one that was always true: keep the kernel patched and reboot after patching, because a kernel update that is not booted is not a fix. The 61-of-948 patched figure is the other side of that: most of these flaws are still working through the reporting pipeline, and they will land as ordinary kernel updates over the coming months, not as one dramatic patch day.
Patch cadence is the defence, and it was already the defence. Nothing in this story changes what a sysadmin does on Monday morning — it changes how much slack there is in doing it late. A kernel that is three months behind was always a risk; it is now a risk with 948 more known paths behind it, and the cost of finding the next 948 just fell to about $1,279 each.
And the container angle, since it is the one people get wrong: a container escape is not what these bugs are, but a local privilege escalation inside a container that reaches the host kernel is the same bug wearing a different hat. The host kernel is the boundary. Patch the host, reboot the host, and a container-level fix is not a substitute — the same lesson as CVE-2026-98432, where the fix was a host kernel update and a reboot, not a container change.
The pipeline did not make Linux less secure. It made the insecurity measurable — and the measurement says the cheap part is finding the bugs, the expensive part is fixing them, and the part that decides whether any of it matters is whether the box gets rebooted into a patched kernel.
# quick reference — the whole post in six lines
The run: 2,308 candidates → 1,724 reproduced → 1,169 working root exploits → 948 distinct flaws, ~7% of the kernel, 10 days, $1,213,430 in API credits.
Fix status: 61 patched upstream, 43 staging, 299 in public discussion — a generated patch is not a deployed fix.
The model: GPT-6 Cyber, announced Nov 5, Critical-rated, approved Daybreak Red customers only, no public signup.
Anthropic: 37,966 candidates, 5,087 disclosed, 629 patched — and human triage, not finding, is the bottleneck.
What it means: local bugs, so a foothold is required — but an unpatched low-privileged account is now functionally root.
What to do: patch the kernel, reboot into it, and stop treating the patch window as slack — there is no CVE list to check against.
Fix status: 61 patched upstream, 43 staging, 299 in public discussion — a generated patch is not a deployed fix.
The model: GPT-6 Cyber, announced Nov 5, Critical-rated, approved Daybreak Red customers only, no public signup.
Anthropic: 37,966 candidates, 5,087 disclosed, 629 patched — and human triage, not finding, is the bottleneck.
What it means: local bugs, so a foothold is required — but an unpatched low-privileged account is now functionally root.
What to do: patch the kernel, reboot into it, and stop treating the patch window as slack — there is no CVE list to check against.
Series: AIStatus: Published 9 Nov 2026