OpenAI pipeline finds 948 Linux kernel LPEs for $1,213,430

OpenAI frames this work as part of Patch the Planet, a Daybreak initiative, and says its broader aim is to help defenders find and fix vulnerabilities before attackers use them. The pipeline's five stages are designed to move from scanning code to reporting vulnerabilities with candidate patches, which the maintainers can review. By building the prototype around an upcoming cyber model and comparing it with an earlier GPT‑5.6 Sol run, OpenAI is trying to show how quickly a stronger base model can change the economics of finding flaws in a codebase the size of Linux.

The research also yielded a set of operational lessons that go beyond the headline exploit count. OpenAI says the Linux maintainers moved quickly: when the scan and manual analysis finished after 10 days, 61 local privilege escalation issues had already been patched upstream, 43 had staging patches, and 299 were being reported and discussed publicly. It recommends revalidating findings against the latest code to avoid duplicate or obsolete reports, since patches can land while a scan is still running. On the exploitation side, OpenAI found its agents employed 10 techniques that kernel exploitation experts had not seen before, and it noted that human review caught 20 exploits that had actually used a different 0-day vulnerability than the one assigned.

Cost data underpins the argument for proactive scanning. OpenAI says the pipeline was net profitable at the time of the research when measured against historical bug bounty payouts: applying Pwn2Own and TyphoonPWN bounty amounts to the 948 exploits produces a hypothetical valuation range roughly 16 to 55 times the pipeline's cost. It also reports that a kernelCTF campaign producing 21 local privilege escalation exploits cost about $32,936 and could have led to around a $1.5M bounty award, approximately 45 times the cost. OpenAI cautions that the reported costs are more of an upper bound, since better harness engineering could reduce spending at each stage, and that its focus was methodology and measuring model capability rather than cost.