OpenAI Details Autonomous Vulnerability Pipeline: An Upcoming Cyber Model Produced Exploits and Patches for 948 Linux Kernel Privilege Escalation Bugs for $1.2M in API Costs
On November 4 OpenAI published "A thousand fewer paths to root." Its autonomous pipeline for vulnerability discovery, validation, exploitation and patching scanned the Linux kernel in mid-October with an upcoming cyber model, reproduced 1,724 vulnerabilities and produced exploits and patches for 948 distinct local privilege escalation (LPE) bugs. The run cost $1,213,430 in API credits, about $1,279 per LPE, and hundreds of reports and patches have already gone to maintainers.
Key Takeaways
- Five-stage pipeline: discovery, dynamic validation, exploitability assessment, patch generation, human review
- Of 2,308 candidate findings, 1,724 were reproduced, yielding 291 info-leak PoCs and 948 distinct LPEs
- Total cost $1,213,430; historical Pwn2Own and TyphoonPWN bounties imply a hypothetical $18.9M to $66.3M value
- The newer model found more than 5x the novel LPEs of a July GPT-5.6 Sol run (166)
- The agents used at least 10 novel Linux exploitation techniques, withheld for safety reasons
Linked Models & Agents:
