OpenAI Pipeline Finds 948 Linux Kernel Privilege Escalation Flaws

OpenAI pipeline finds 948 Linux kernel privilege escalation flaws

OpenAI says it has built an autonomous research pipeline that discovered, validated, and produced working exploits for nearly a thousand local privilege escalation vulnerabilities in the Linux kernel. The company reports that the system identified 2,308 candidate findings, dynamically reproduced 1,724 of them, and ultimately generated 948 functional exploits that could let an unprivileged local user gain root access. Human researchers reviewed every output before the findings were passed to kernel maintainers along with candidate patches.

The work expands on what OpenAI shared in June through its Patch the Planet initiative, when the company said GPT-5.5 Cyber had found Linux kernel flaws and developed 24 exploits to validate them. The new pipeline uses what OpenAI describes as an upcoming cyber model and runs through five stages: vulnerability discovery, dynamic validation, exploitability assessment, patch generation, and human review. At the end of the process the system packages a root cause analysis, a minimal crashing proof of concept, a candidate patch, and a full exploit to help human reviewers judge severity and upstream the fixes.

OpenAI chose the Linux kernel because it underpins Android devices, cloud infrastructure, supercomputers, and other systems used by billions of people. With more than 40 million lines of code, the kernel presents a broad attack surface through system calls, networking, filesystems, and device drivers. The company wanted to study how effectively frontier models could find vulnerabilities and demonstrate their security impact in a codebase of that scale and importance.

Scout agents identify high-value audit targets

The discovery stage used what OpenAI calls Scout agents to identify high value audit targets based on reachability by low privileged users and security relevance. Those agents flagged 5,034 targets covering roughly 2.8 million lines of code, about seven percent of the entire kernel. That step cost $3,426 in API credits. Analyst agents then scanned each target and produced 2,308 candidate findings after deduplication, finishing within 12 hours at a cost of $316,549 in API credits.

Validation bottleneck overcome with 1724 reproductions

Validation turned out to be the real bottleneck. A candidate finding is not the same as a validated vulnerability, and manually investigating thousands of reports is impractical. The pipeline focused on findings reachable by a low privileged user, requiring no special capabilities, and producing measurable evidence of memory corruption. For each candidate a triage agent generated a proof of concept and ran it in an isolated virtual machine with Kernel Address Sanitizer enabled. The agent watched both program output and the system console, then iteratively refined the proof of concept until it reproduced the reported behavior or exhausted the trigger possibilities.

Within 30 hours the system reproduced 1,724 vulnerabilities, about 74.7 percent of the candidates. OpenAI says it was impressed by the accuracy of the analyst agents and the effectiveness of the triage agents in autonomously creating working proofs of concept for almost three quarters of the findings. Most of the remaining candidates either required elevated privileges or failed to reproduce within the time budget because of difficult race conditions, specific trigger conditions such as a required allocation failure at a specific line, or time consuming validation such as reference count wraparound. Only 3.1 percent reflected incorrect analysis where the model assumed an impossible condition. The validation stage cost $73,330 in API credits.

Exploitability assessment came next. Validation establishes that a vulnerability is real but not how urgently it should be addressed. An initial screening agent reviewed each report, crash log, and relevant source code statically, filtering out cases without a plausible exploitation path while remaining permissive enough to avoid discarding potentially serious findings. That narrowed the results to 313 information leak candidates and 1,238 local privilege escalation candidates.

Exploit development tests hardened kernel protections

Exploit development agents then tested those candidates in isolated virtual machines configured with the protections enabled by a standard Linux distribution, including Supervisor Mode Execution Prevention, Supervisor Mode Access Prevention, Kernel Address Space Layout Randomization, and HARDENED USERCOPY. This prevented unrealistic assessments that depended on protections being disabled. The agents produced 291 proofs of concept for information leaks and 1,169 working local privilege escalation exploits. After human review, 948 of those exploits were confirmed and reported alongside patches.

OpenAI reports API costs for each stage to help other researchers assess the resources needed to reproduce or extend the work. The company emphasizes that these costs reflect the specific models, target configurations, and workflow used in this evaluation and represent an upper bound. Sufficient harness engineering could meaningfully reduce the cost at each stage. The broader goal is to help defenders find and fix vulnerabilities, reducing the opportunities available to attackers and raising the cost for them to exploit software.

Frequently asked questions

How many Linux kernel privilege escalation vulnerabilities did OpenAI's pipeline discover and validate?

OpenAI's autonomous pipeline identified 2,308 candidate findings, dynamically reproduced 1,724 of them, and ultimately generated 948 functional local privilege escalation exploits that were confirmed by human reviewers and reported to kernel maintainers with candidate patches.

What are the five stages of OpenAI's vulnerability research pipeline?

The pipeline runs through five stages: vulnerability discovery using Scout agents, dynamic validation with triage agents creating proofs of concept, exploitability assessment via screening and exploit development agents, patch generation, and human review of all outputs before reporting to maintainers.

Why did OpenAI choose the Linux kernel for this research?

OpenAI chose the Linux kernel because it underpins Android devices, cloud infrastructure, supercomputers, and other systems used by billions of people. With over 40 million lines of code, it presents a broad attack surface through system calls, networking, filesystems, and device drivers.

How much did each stage of the pipeline cost in API credits?

The discovery stage cost $3,426 for Scout agents flagging 5,034 targets. Analyst agents produced 2,308 candidates in 12 hours at $316,549. Validation reproduced 1,724 vulnerabilities in 30 hours for $73,330. OpenAI notes these costs reflect their specific models and workflow and represent an upper bound.

What protections were enabled during exploit development testing?

Exploit development agents tested candidates in isolated virtual machines configured with standard Linux distribution protections including Supervisor Mode Execution Prevention (SMEP), Supervisor Mode Access Prevention (SMAP), Kernel Address Space Layout Randomization (KASLR), and HARDENED USERCOPY to prevent unrealistic assessments.

Source: OpenAI