OpenAI's AI pipeline reports 948 distinct Linux kernel root vulnerabilities for $1.2M

In a mid-October run, an unreleased OpenAI cyber model generated 948 distinct local privilege escalation flaws in the Linux kernel, each with a path to root access. The total API cost was about $1.21 million, roughly $1,280 per vulnerability. The pipeline narrowed the kernel to code reachable by unprivileged users, then had agents validate flaws in virtual machines and attempt root exploits, with common protections like KASLR, SMEP, and SMAP enabled. The bugs are local rather than remote, so an attacker would still need an initial foothold, and the findings are counted as vulnerabilities rather than merged fixes. OpenAI says human engineers review exploits and patches before disclosure, starting with the most severe cases and sending reports to kernel maintainers gradually.