OpenAI Cyber Team Validates 948 Unique Linux Kernel LPE Vulnerabilities Using Autonomous AI Pipeline

• OpenAI Cyber developed an autonomous pipeline to discover, exploit, and patch Linux kernel Local Privilege Escalation (LPE) vulnerabilities, validating 948 unique LPE exploits and 291 information leak PoCs in mid-2026.
• The campaign targeted the latest Linux kernel master branch under standard desktop OS threat models (Pwn2Own/TyphoonPWN), costing $1,213,430 in API fees, which is estimated to be 16 to 55 times less than the hypothetical value of the found exploits.
• The pipeline identified 2,308 candidate vulnerabilities, dynamically validating 1,724 (74.7%) in isolated VMs, with the final exploit generation phase costing $775,929.
• The agents discovered 10 new Linux exploitation techniques, including persistent elastic object sprays and data-only methods, which were confirmed as novel by third-party experts.

Pipeline Performance and Costs

• The pipeline identified 2,308 candidates, with dynamic validation in KASAN-enabled VMs costing $73,330.
• ExploitDev agents generated exploits in VMs with standard protections (SMEP, SMAP, KASLR), with successful LPE development averaging $359 per exploit compared to $3,922 for failed attempts.
• A separate test on the hardened kernelCTF environment yielded 21 LPE exploits for $32,936, representing a 45x return on investment if accepted.

Model Capabilities and Orchestration

• The October 2026 upcoming cyber model found 948 unique LPEs, significantly outperforming the July 2026 GPT-5.6 Sol model which found 166 unique LPEs.
• Stronger models require lighter orchestration; GPT-5.6 Cyber outperformed GPT-5.5 Cyber with a lightweight workflow, while adding technique layers to GPT-5.6 yielded only a 1.5 percentage point improvement.
• The team discovered a QEMU TCG vulnerability in their own test infrastructure, highlighting the need to secure testing environments before offensive research.

Patching and Defense Implications

• AI-generated patches were refined through iteration to meet functional and style requirements, with the research prototype identifying issues in human-written patches.
• OpenAI recommends treating unpatched low-privilege accounts as equivalent to root access and using sandboxing (Firecracker, gVisor) to limit blast radius.
• The initiative aims to expand to other critical open-source projects through the 'Patch the Planet' partnership to raise the cost of exploitation for attackers.