OpenAI says an agent pipeline with an unreleased cyber model found 948 Linux kernel privilege-escalation flaws in one run, The Hacker News and Unite.AI report

OpenAI published a post on 4 November, “A thousand fewer paths to root”, about an automated pipeline for finding Linux kernel flaws. Its page refused us twice, so the figures here are as The Hacker News and Unite.AI each report them.

The pipeline has five stages: it finds candidate bugs, reproduces them in a sandbox, writes proof-of-concept exploits, generates patches and passes the results to human reviewers before kernel maintainers are told, both outlets report.

In one run in mid-October with what OpenAI calls an upcoming cyber model, the pipeline produced 2,308 candidate kernel findings and reproduced 1,724 of them within 30 hours. It ended with 948 local privilege-escalation flaws and 291 proof-of-concept exploits for information leaks. The run cost $1,213,430 in API credits, The Hacker News reports, and Unite.AI gives $1.213 million.

The Hacker News reports that the work turned up at least ten new exploitation techniques, and Unite.AI reports that the full technical details were withheld for safety reasons. The patches are candidates, not shipped fixes.

The post follows Anthropic's report on 29 October that an unreleased model built working attack chains against major browsers and operating systems. Both labs are now counting AI-found flaws in the hundreds.

• Reported One run produced 2,308 candidate findings, reproduced 1,724 within 30 hours and ended with 948 privilege-escalation flaws, The Hacker News reports. The Hacker News
• Reported The run cost $1,213,430 in API credits, The Hacker News reports; Unite.AI gives $1.213 million. The Hacker News
• Claimed OpenAI says the run used an upcoming cyber model and found at least ten new exploitation techniques, as The Hacker News reports. The Hacker News