948 Ways to Become Root, Found by Machine for About $1,279 Each: The Numbers Behind OpenAI’s Linux Kernel Experiment
OpenAI says an automated pipeline running on an upcoming AI model produced 948 working Linux privilege-escalation exploits in one run, along with patches. The figures, and why an unpatched system with any user account should now be treated very differently.
OpenAI has published research describing an automated system that, running on a cyber-focused AI model it has not yet released, turned hundreds of Linux kernel bugs into working attacks that let an ordinary user take full control of a machine. It also wrote a patch for each flaw. The figures are striking enough that they are worth reading one at a time.
We relied on Help Net Security’s summary of the research and The Hacker News’ coverage, which quote OpenAI’s post at length.
The run, by the numbers
- About 7%: the share of the kernel that a first set of AI agents picked out as reachable by low-privileged users and worth auditing.
- 2,308: candidate bugs a second set of agents reported within 12 hours.
- 1,724 (74.7%): candidates that triage agents actually reproduced inside isolated virtual machines, within 30 hours.
- 291 and 1,169: proof-of-concept information leaks and working root exploits produced, tested against a stock desktop install of a commonly used distribution with standard protections switched on.
- 948: distinct vulnerabilities behind those root exploits, once duplicates were grouped.
- $1,213,430: total API cost of the mid-October run, or about $1,279 per exploit.
- 10: exploitation techniques that OpenAI and outside kernel experts say they had not seen before, based on a sample of 166 exploits. OpenAI withheld the technical details for safety reasons.
- 61, 43 and 299: bugs patched upstream, bugs with staging patches, and bugs being reported and discussed publicly when the scan and manual review wrapped up after 10 days.
The caveats OpenAI raised itself
The agents’ own reports were not always right. In an early run, the system claimed 200 successful root exploits, but human reviewers found that 20 had reached root through a different, previously unknown bug than the one assigned. OpenAI tightened the rules and added an independent check, and security researchers review every exploit, patch and severity rating before anything goes to kernel maintainers. On a hardened test kernel with a reduced attack surface, the pipeline produced far fewer results: 21 privilege-escalation exploits and 25 information-leak proofs over 112 hours.
The sentence that matters most
OpenAI’s researchers wrote that, for the near and medium term, having a low-privileged account on an operating system that is missing its latest patches should be considered functionally equivalent to root access for a well-resourced attacker. They recommend layered defenses such as sandboxing and isolation to limit damage when a flaw is exploited, and say they are sending reports and patches to maintainers, starting with the most serious issues.
What this means for your company
You do not need to run Linux desktops for this to matter: Linux sits inside cloud servers, firewalls, storage boxes and Android phones. The practical takeaway is that the gap between a bug being found and being exploitable is shrinking, and so is the comfort of “they would need to log in first.” Keep systems and appliances on a regular, fast patch schedule, limit who has accounts on servers, remove old and shared logins, and isolate workloads so one compromised account cannot reach everything.
Wondering how long your servers and appliances actually go between patches, and who still has a login on them? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
