Low-privileged accounts on unpatched systems as good as root: OpenAI

OpenAI said its upcoming cyber security model developed no fewer than 948 distinct Linux kernel privilege-escalation exploits in a US$1.21 million automated research exercise.

That result suggests defenders should change how they view ordinary user accounts which have restricted access rights, as on unpatched systems their privileges could be escalated, the artificial intelligence vendor contended.

"For the near and medium term, having access to a low-privileged account on an operating system, that isn't up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor," OpenAI said.

For the exercise, OpenAI built a pipeline around the unnamed and unreleased model to find find, validate, exploit and to patch Linux kernel flaws, with human researchers reviewing the results.

�� A thousand fewer paths to root My @OpenAI colleague @ky1ebot built an autonomous vulnerability discovery, exploitation, and patching pipeline. In one run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation (LPE) vulnerabilities in Linux at an API cost of $1.2 million. Each LPE lets an unprivileged local user gain root access. To the best of our knowledge, the agents in this pipeline discovered and used at least 10 novel Linux exploitation techniques. We wrote a blog about: - How the pipeline works - The cost of each stage - Our findings and learnings https://t.co/MFAVrGSJuq

— Clint Gibler (@clintgibler) November 4, 2026

The OpenAI AI agents scanned about 2.8 million lines of code that ordinary users can interact with.

This amounts to roughly seven percent of the kernel, and the agents' efforts produced 2308 candidate findings within 12 hours, of which 1724 were reproduced in virtual machines.

The agents then built working exploits against a stock desktop Linux distribution with standard kernel protections enabled.

OpenAI grouped these into 948 distinct flaws, one for each patch it developed, with the whole run taking 10 days.

A precedent to the October exercise was an OpenAI internal evaluation this July, in which agents working from inside a JFrog Artifactory container found a publicly disclosed flaw, CVE-2026-53362, in the host system's Linux kernel.

They adapted a public exploit to escalate their privileges and took root control of the underlying worker node, before moving laterally through the connected environment.

That July escape came days after OpenAI agents chained zero-days in the same Artifactory software to break out of their test environment and hack machine learning community provider Hugging Face.

AI bug hunting becomes cheaper

While the July breakout used a known flaw, OpenAI’s figures show that finding unknown ones is getting cheaper.

A July run using GPT-5.6 Sol found 166 unique privilege escalation flaws for US$513,690 ($739,377), or about US$3094 each.

Meanwhile, the October run found more than five times as many at less than half the cost per flaw, despite three months of intervening kernel hardening.

OpenAI calculated the economics of the October bug finding, and found it works out at US$1279 per flaw, a figure the company's researchers described as an upper bound.

Even so, the amount compares favourably to bug prizes given out in traditional security vulnerability finding competitions.

"Historically, Pwn2Own and TyphoonPWN offered a US$20,000 and US$70,000 bug bounty for Linux kernel LPE exploits."

"Applying those historical bounty amounts to the 948 exploits produces a hypothetical valuation of US$18.9M—US$66.3M, approximately 16x to 55x our pipeline’s cost," the OpenAI researchers wrote.

OpenAI expects that within a few years even less capable models could be able to develop exploits once vulnerabilities are disclosed.

The company said it had submitted hundreds of reports and candidate patches for critical flaws to the Linux kernel maintainers with further findings to be released gradually through its Patch the Planet partners.

It is not alone in the hunt.

By the end of its mid-October scan, which took 10 days including manual analysis, OpenAI said other contributors had already patched 61 privilege escalation flaws upstream and prepared staging patches for 43, with 299 more under public discussion.

In May a parallel discovery of Linux kernel bugs led to an embargo breach and premature disclosure of the Dirty Frag privilege escalation flaws.

At the time, kernel stable maintainer Greg Kroah-Hartman said different groups were reporting the same issues within days.

To mitigate cheap, AI-found LPEs, OpenAI recommended defence in depth, such as sandboxing and isolation with Firecracker and gVisor, to limit damage from exploited kernel flaws.

However, OpenAI said testing of its own infrastructure had also turned up many vulnerabilities in Kata, Moby/Docker, gVisor and other projects, which it disclosed and helped patch.

Parts of OpenAI's research cannot yet be independently verified.

OpenAI did not name the distribution or the model used, and withheld details of 10 exploitation techniques it described as novel, citing safety concerns.