The most interesting security news this week was not a breach. It was OpenAI posting that an autonomous pipeline found, proved, and drafted fixes for 948 local privilege escalation bugs in the Linux kernel, in one run, for $1,213,430 in API credits.
Local privilege escalation means a regular user account on a machine can become root. No phishing, no network access, no zero-click anything. Just a local user and a bug in the kernel, and the machine belongs to them. There are millions of Linux servers running right now where this matters.
The pipeline ran in mid-October on an unreleased cyber-focused model, and the numbers came out on November 4 in a research post. The shape of it is what I want to talk about, because the shape is the product.
Scout agents picked 5,034 audit targets, about 2.8 million lines of code, roughly 7% of the kernel. That is the reachability filter: only the parts a low-privileged user can actually get to.
Analyst agents produced 2,308 candidate findings in 12 hours.
Triage agents tried to prove the candidates. Proof of concept code, run in isolated VMs with Kernel Address Sanitizer on. Within 30 hours, 1,724 findings were reproduced, about 74.7%. Only 3.1% were wrong because the model assumed an impossible condition. That 74.7% hit rate against its own guesses is the part nobody’s benchmark suite measures.
Exploit agents then tested the bugs against hardened systems: SMEP, SMAP, KASLR, HARDENED_USERCOPY. The result was 1,169 working exploits and 291 information leak proofs, which after variant analysis became 948 unique bugs and 948 draft patches. Human researchers reviewed everything before it went anywhere. OpenAI sent reports upstream and is pushing the rest through Patch the Planet partners under its Daybreak program.
Now the economics, because they are the uncomfortable part. At $1.2M total, each working exploit cost about $1,279 in API credits. OpenAI calls that an upper bound and expects tooling to cut it. Compare to the bounty market: at Pwn2Own and TyphoonPWN rates, those same 948 bugs would be worth somewhere between $18.9M and $66.3M. On a hardened kernelCTF setup the pipeline earned 21 exploits for $32,936, which OpenAI estimates equals about $1.5M in rewards against Google’s $71,337 per eligible exploit. The gap between what AI pays to find a bug and what humans get paid to find one is not a rounding error. It is two orders of magnitude.
There is also a trend line inside the numbers. A July run with a different model found 166 unique bugs for $513,690. The October run found 948, more than five times as many, against a kernel that had three more months of hardening behind it. Cost went up 2.4x, findings went up 5.7x.
The honest caveats are the ones OpenAI published itself, which is refreshing. In one early run, 20 of 200 “successful” exploits gained root through a different zero-day than the one they were assigned. The agents found the right destination by taking the wrong road, and only human review of how the exploit worked caught it. The agents also found a QEMU flaw in the test harness itself, and used at least 10 exploitation techniques kernel experts had not seen, details withheld for safety reasons. Translation: this thing found bugs nobody knew about, and the outputs need real review before anyone breathes easy.
The maintainers did not sit on it. Within 10 days, 61 bugs were patched upstream, 43 had staged patches, and 299 were in public discussion. That is the fastest kernel security response cycle I can remember reading about, and it happened because the reports arrived with proof-of-concept code attached, not a vague advisory.
Why this matters beyond one kernel. For two years, the agent debate has been about whether models can write code. This run is about whether models can prove code: generate an exploit, run it, survive hardening, and hand over something a human can verify. That is the verification loop every multi-agent system eventually hits, and OpenAI just published a reference run of it at industrial scale, with costs, hit rates, and failure modes included. The security industry priced bugs at human-speed wages. That pricing is now historical.
The practical takeaway if you run Linux servers: treat an unpatched machine’s low-privileged accounts as effectively root access for a well-funded attacker, patch kernels fast, and limit unprivileged user namespaces where you can. The pipeline is already reporting to vendors through coordinated channels, but the window between exploit-in-a-lab and exploit-in-the-wild has never been shorter.