OpenAI's Security Model Found 948 Ways to Become Root on Linux

A security model built by OpenAI found 948 separate ways for a local user to become root on a Linux machine, after sifting about 2.8 million lines of kernel code. The company published the results on 4 November as a demonstration of what automated vulnerability hunting can now do.

The pipeline has five stages: find candidate code, reproduce the bug, judge whether it can be exploited, write a patch, and put the result in front of a human. In the discovery stage, one AI agent selected code worth auditing and a second analysed it, producing 2,308 distinct candidate flaws in twelve hours for $316,500 in API calls.

Reproduction is where most automated scans stop, and here it is where the numbers get interesting. Each candidate went into an isolated virtual machine, where the system wrote a proof of concept and watched what happened. Of the 2,308 candidates, 1,724 — about 75% — reproduced. Only 3.1% failed because the model had simply got the analysis wrong; the rest were blocked by permissions, timing or hard-to-trigger conditions.

The exploits that followed were tested against a kernel with the usual defences switched on, including SMEP, SMAP, KASLR and hardened usercopy. That produced 291 information-leak proofs of concept and 1,169 working local privilege escalations, narrowed to 948 distinct bugs after variant analysis.

The whole exercise cost $1.21 million in API credit, or about $1,279 per privilege-escalation exploit — not an optimised figure, the company notes, just what this configuration cost. For comparison, a similar run in July with an earlier model found and exploited 166 such bugs for $513,700. The kernel had been hardened in between, and the count still rose more than fivefold.

Patches came too, and they were the weakest part. Early fixes closed the specific proof of concept but drifted from the project's coding style, added unnecessary code or missed sibling bugs; more constraints and several rounds of iteration improved them. Some, OpenAI says, exposed problems in fixes human developers had already written.

The consequences are already landing upstream. In the ten days after the scan, 61 of the flaws were fixed in Linux, 43 more have staged patches, and 299 are in discussion. The company's conclusion is uncomfortable for anyone who defers updates: if a frontier model can find these bugs today, a weaker one may soon be able to use the ones already published.