OpenAI reports 948 Linux LPE exploits from a multi-stage agent audit, with a costly validation bottleneck

OpenAI's November 4 publication describes an automated security research pipeline operating on the Linux kernel. It selected 5,034 targets spanning about 2.8 million lines, generated 2,308 deduplicated candidate findings, reproduced 1,724 vulnerabilities and developed 948 distinct local privilege escalation exploits in controlled environments. The reported API-credit cost was $1,213,430, approximately $1,279 per distinct LPE exploit. These are research-run accounting figures, not a service price or an estimate of criminal exploitation cost.

The pipeline had separate scout, analyst, dynamic confirmation, exploitation and patch-generation steps. Its initial success oracle was too weak: in an early set of 200 apparently successful root escalations, human review found that 20 exploited another zero-day rather than the assigned vulnerability. That means observing a root shell was insufficient to validate an asserted cause. The pipeline was changed to check root-cause correspondence. OpenAI also reported 61 vulnerabilities patched upstream at the end of the scan, 43 under staging patches and 299 under public discussion; generated candidate patches do not equal shipped fixes. Human validation and Linux-maintainer review remained material to safe deployment.

A separate QEMU weakness found inside the test environment is not included as a Linux-kernel flaw. The testing infrastructure case documents that distinction.

The exploit funnel includes 291 information-disclosure proofs of concept in addition to the 948 reported local privilege-escalation results. They are different effect classes and must not be added into a single number of independently compromised systems. OpenAI's mid-October research targeted a stock test distribution, while its modified kernelCTF run found 25 information-leak PoCs and 21 LPEs under a different configuration; the study notes that SLAB_VIRTUAL was disabled for compatibility. Those kernelCTF outcomes were not awarded bounties or accepted as contest submissions.

The maintained artifact is not just an exploit. A reproducible finding should identify the original kernel revision, the faulting path, effect proof, candidate patch, maintainer disposition and deployed fixed release. The QEMU TCG detour shows why one apparent root shell cannot replace that provenance chain. As of the report's end-of-scan snapshot, upstream, staging and public-discussion counts were 61, 43 and 299. The source does not supply an exhaustive published mapping from all 948 results to currently running distribution kernels.