OpenAI: A thousand fewer paths to root

Evidence record

November 4 technical publication documenting kernel target counts, exploit funnel, costs, human checks, QEMU finding and patch-review status.

Read the original source ↗

Claim-level citations (5)

• supportsOpenAI reports 948 Linux LPE exploits from a multi-stage agent audit, with a costly validation bottleneck: OpenAI reports $1,213,430 in model API credits for the full campaign; dividing by 948 results yields about $1,279 per reported LPE, exclusive of human review and deployed remediation costs.

  Cost analysis and total campaign cost breakdown

• supportsOpenAI reports 948 Linux LPE exploits from a multi-stage agent audit, with a costly validation bottleneck: OpenAI reports that its Linux audit pipeline produced 948 distinct local privilege-escalation exploit results after 2,308 candidate findings and 1,724 dynamic reproductions.

  The vulnerability research pipeline; Findings; count and exploitability tables

• supportsOpenAI reports 948 Linux LPE exploits from a multi-stage agent audit, with a costly validation bottleneck: Human reviewers found 20 of 200 early purported LPE successes had exploited a different zero-day from the intended target; the evaluation pipeline subsequently changed its attribution checks.

  Using the wrong 0-day

• supportsOpenAI reports 948 Linux LPE exploits from a multi-stage agent audit, with a costly validation bottleneck: OpenAI reported that, when its October 2026 scan and manual analysis concluded after ten days, 61 Linux LPE findings had upstream fixes, 43 had staging patches and 299 were in public discussion; those statuses do not establish deployment across affected distributions.

  Findings, Maintainers are moving quickly to patch vulnerabilities, end-of-scan status paragraph

• supportsA Linux exploit agent found a QEMU TCG privilege-escalation flaw in its test harness: OpenAI reports its kernel-research pipeline found and exploited a QEMU TCG vulnerability that was already fixed upstream but remained in the experimental release build.

  Vulnerabilities in testing infrastructure