OpenAI has developed an autonomous pipeline for discovering, validating, and patching security vulnerabilities using an upcoming cyber model. In a mid-October 2026 run, the system identified 2,308 candidate Linux kernel findings and dynamically reproduced 1,724 vulnerabilities. The pipeline successfully generated 948 working local privilege escalation exploits that could allow an unprivileged user to gain root access, at an API cost of $1,213,430.
The automated process identifies security-relevant parts of the Linux kernel, performs static scans, reproduces findings in an isolated environment, creates proof-of-concept exploits, and generates candidate patches. OpenAI reported that the agents used at least 10 novel Linux exploitation techniques during the process. Human security researchers reviewed the outputs before reporting the vulnerabilities and proposed fixes to maintainers.
OpenAI noted that the cost of the run averaged approximately $1,279 per local privilege escalation exploit. The company compared this to historical bug bounty programs, noting that applying previous bounty amounts to the 948 exploits would result in a hypothetical valuation between $18.9 million and $66.3 million. In a separate test on an adapted kernelCTF environment with a reduced attack surface, the pipeline produced 21 local privilege escalation exploits at a cost of roughly $32,936.
