OpenAI says an AI pipeline it built produced 948 working Linux privilege escalation exploits in a single run, according to its Nov. 4, 2026 post. The practical advice is ordinary: install your distribution's kernel updates and reboot. These are OpenAI's own figures. We have not seen the exploits or verified the numbers.

What OpenAI reports

In its post, OpenAI describes an autonomous pipeline that finds, exploits and patches Linux kernel bugs. In one run in mid-October 2026, it says the pipeline analyzed 2,308 candidate kernel findings and dynamically reproduced 1,724 vulnerabilities.

From those, OpenAI says in its post it produced 948 working local privilege escalation (LPE) exploits, meaning an unprivileged local user could gain root. It also says it generated proofs of concept for 291 information leak bugs.

OpenAI puts the run's cost at $1,213,430 in API credits, or $1,279 per LPE exploit, in the same post. It calls that figure closer to an upper bound.

Which Linux, and what model

OpenAI does not name the distribution or the kernel version. Its post says the exploits target "a commonly used Linux distribution," running as a stock desktop operating system rather than a weakened target. It says the scan used "the latest Linux kernel in mid-October 2026."

The model is not public. OpenAI says in the post the run used "an upcoming cyber model," in a controlled research environment, and that human researchers review findings before they are reported to maintainers.

Where fixes stand

OpenAI says in its post it developed candidate patches for maintainer review and began with critical bugs, following guidance from the Linux kernel community.

By OpenAI's count, when the 10-day scan finished, 61 of the LPEs had already been patched upstream and 43 had staging patches. It says 299 more were being reported and discussed publicly.

OpenAI does not say how those counts map to the 948 exploits. This is a different issue from the TCP use-after-free CVE-2026-98432, a separate bug with its own advisories.

What we checked

As of Nov. 5, 2026 (ET), we read OpenAI's post again; the 61, 43 and 299 figures had not changed. We did not find a kernel.org or kernel mailing list record showing which of the 948 exploits are fixed or merged, so the 61, 43 and 299 figures are OpenAI's alone.

We also found no CVE ids tied to this run and name none. We have not seen the exploits, so we cannot say how reliable they are or how they would behave on your system.

What to do on your Linux machines

Local privilege escalation needs a foothold first: an attacker must already have an account or code running on the machine. It does not let someone break in from the internet by itself.

Still, OpenAI's own view is blunt. It says that for the near and medium term, a low-privileged account on an operating system that is not up to date on patches should be treated as functionally equivalent to root access for a well-resourced attacker.

  1. Update: install your distribution's kernel updates, then reboot. A new kernel only runs after a restart.
  2. Check the running kernel: run uname -r and compare it with your distribution's latest kernel.
  3. Limit local accounts: remove accounts and shared logins you no longer need, especially on shared servers and build machines.

Why it matters

The claim is about speed and cost: a million-dollar run that OpenAI says yielded hundreds of working exploits. Defenders face the same trend; see how AI agents broke into more than 100 sites in another recent report.

Whether the numbers hold up will depend on maintainers and independent researchers reviewing the reports.