OpenAI’s Cyber team describes a five-stage vulnerability research pipeline that uses an upcoming cyber model to scale Linux kernel security work. The prototype scanned the latest Linux kernel master branch in mid-October 2026, produced 2,308 candidate findings, dynamically validated 1,724 of them, and ultimately identified 948 unique local privilege escalation (LPE) vulnerabilities, with working exploits that give an unprivileged local user root access. The team reported critical vulnerabilities to maintainers and is working with Patch the Planet partners on the rest.

The pipeline starts with Scout agents that pick audit targets by reachability and security relevance. This narrowed the codebase to 5,034 targets (about 2.8 million lines, roughly 7% of the kernel) for $3,426 in API credits. Analyst agents then reviewed each target, producing 2,308 candidates in 12 hours at $316,549. Triage agents built proofs of concept in isolated KASAN-enabled virtual machines, reproducing 1,724 findings (~74.7%) in 30 hours for $73,330. Most failures came from privilege requirements, race conditions, or time-consuming triggers; only 3.1% were incorrect model analysis.

Exploitability assessment first used a permissive static screener, narrowing results to 313 information leak candidates and 1,238 LPE candidates. ExploitDev agents then worked in VMs with standard distro protections (SMEP, SMAP, KASLR, HARDENED_USERCOPY), producing 291 info leak PoCs and 1,169 working LPE exploits. Variant analysis reduced those to 948 unique vulnerabilities behind the exploits. Screening cost $44,194; exploitation cost $775,929. Successful LPE exploits averaged around $360 each, while unsuccessful attempts averaged $3,922; the article recommends a give-up condition after an hour without progress. Patch generation produced candidate patches, and hundreds were already sent to Linux maintainers.

The article reports several findings. Maintainers patched quickly: by the time the 10-day scan and review finished, 61 LPEs were patched upstream, 43 had staging patches, and 299 were being discussed publicly, so revalidating against latest code is important. Model capability matters: GPT-5.6 Sol found 166 unique LPEs for $513,690 in late July 2026, while the newer cyber model found 948 for $1,213,430 in mid-October. Agents also used 10 exploitation techniques that, to the team’s knowledge, were new to third-party experts; details were omitted for safety.

Defenders can treat exploit cost as a metric. Applying historical Pwn2Own/TyphoonPWN bounty amounts ($20,000 and $70,000 per kernel LPE exploit) to the 948 exploits gives a hypothetical value of $18.9M–$66.3M, roughly 16–55x the pipeline’s cost. In kernelCTF’s hardened environment, the pipeline got 25 info leak PoCs and 21 LPE exploits in 112 hours for about $32,936, worth around $1.5M if accepted, about 45x the cost; only 26 confirmed 0-day LPEs had been accepted by the program in 2026 at the time of writing. Other lessons: an early run had 20 reported exploits that reached root through a different 0-day than assigned, so independent checks are needed; stronger models need lighter orchestration (a 103-technique layer helped GPT-5.5 Cyber from 76.2% to 88.9% but added only 1.5 percentage points for GPT-5.6 Cyber); and iterative prompts improved patch quality, sometimes even catching problems in human-written patches.

The prototype also found a QEMU TCG vulnerability while analyzing kernel code, later confirmed fixed upstream but present in the release build used during the experiment. The team recommends testing research infrastructure itself and points to its prior vulnerability disclosures in Kata, Moby/Docker, and gVisor. Overall, the post argues that frontier model capability can be converted into a defensive advantage by making vulnerability discovery and patching cheaper for defenders and more expensive for attackers.