OpenAI's AI agents built 948 attacks that let an ordinary user take over a Linux machine
OpenAI says an unreleased model built working attacks for 948 Linux flaws in one run, about $1,279 each, and proposed a fix for each.
The Linux kernel is the core of the operating system behind Android phones, most cloud servers and supercomputers. On 4 November 2026, OpenAI reported that AI agents running a cyber model it has not released had searched the latest kernel for security flaws. They built 948 working exploits (programs that use a flaw to attack a system). Each lets someone with an ordinary account on a machine take full control of it, known as root. The targets ran a standard desktop Linux with its normal protections on.
The run took place in mid-October. The agents flagged 2,308 possible bugs in 12 hours, then reproduced 1,724 of them (74.7%) on isolated test machines in 30 hours. It cost $1,213,430 in API fees, about $1,279 per exploit. Hacking contests have paid $20,000 to $70,000 for a single exploit of this kind. In June, OpenAI’s GPT-5.5 Cyber had produced 24.
Every exploit came with a proposed fix. Human security researchers reviewed each one before it went to the kernel’s maintainers. Ten days after the scan, 61 flaws were fixed in the main kernel, 43 had fixes in testing and 299 were under public discussion. In a sample of 166 exploits, OpenAI found 10 attack techniques that neither it nor outside kernel experts had seen before.
OpenAI’s advice is to patch quickly. Until a system is up to date, it says, an ordinary account on it should be treated as “functionally equivalent to root access” for a well-funded attacker.
What it means
Finding and exploiting this kind of flaw is becoming fast and cheap for a lab with a strong enough model. For anyone who runs Linux machines, installing kernel updates quickly now matters more. The model is not public, and these flaws need an account on the machine first, so this is not a new way to break in from the internet.
Caveats
- The numbers are OpenAI’s own. It withheld the technical details for safety, so nobody outside can check the count yet.
- These are local flaws. An attacker needs an account on the machine first; none of them breaks in from the internet by itself.
- The agents’ own success reports were not always right. In an earlier run, 20 of 200 claimed exploits reached root through a different, unassigned flaw, so OpenAI added an independent check.
- Most of the flaws were still unfixed when OpenAI published: 61 of 948 had been patched in the main kernel after ten days.
- The model is not public, so the result says what a lab can do today, not what anyone with an API key can do.