OpenAI AI pipeline patches 948 Linux kernel flaws

OpenAI's post, published on November 4, 2026, under the title "A thousand fewer paths to root," describes a five-stage workflow that analysts can group into three: find suspicious code, verify it by actually running exploits, then write candidate patches for human review. The run targeted the latest Linux kernel mainline branch as of mid-October. Of 2,308 candidates, 1,724 were reproduced and 1,169 working exploits were executed, which after grouping required 948 distinct patches.

The body highlights a review step that resists full automation. Early in the run, 20 of 200 reported "successes" actually reached root through a different unknown flaw than the one assigned, which OpenAI uses to argue that the path to a result must be checked, not just the result. Early patches also suffered from excess code, slowdowns, style violations, and missed related flaws, while in some cases the AI caught problems in human experts' fixes.

The economics cut both ways. OpenAI estimated that paying bug-bounty rates of $20,000 to $70,000 per flaw across the 948 would total $18.9 million to $66.3 million, about 16 to 55 times the run's cost, and described a separate kernelCTF-oriented run costing about $33,000 against roughly $1.5 million in potential bounties as profitable. It also said the AI used at least 10 attack techniques unknown to experts, withheld for safety. OpenAI has not said when, to whom, or under what conditions the upcoming cyber model will be available.