AI Just Found 948 Ways to Take Over a Linux Computer — OpenAI's 'A Thousand Fewer Paths to Root' Explained (November 2026)

AI-generated illustration for this article — a concept image, not a screenshot of any real product or system.

On 4 November 2026, OpenAI published a research post with a title that sounded almost like a boast: "A thousand fewer paths to root." Behind that title was a result that stopped many security researchers in their tracks. OpenAI 948 Linux kernel bugs is the short version of the story, but the short version does not do it justice. An autonomous pipeline built on an upcoming cyber model from OpenAI had scanned part of the Linux kernel, found thousands of possible flaws, tested them in a virtual machine, turned hundreds of them into working exploits that gave the attacker full administrator control, and then drafted a patch for every single one of them. The final count, according to OpenAI, was 948 distinct vulnerabilities, each one validated with a working exploit and each one supplied with a candidate fix.

That sentence deserves to be read twice, because every part of it matters. This was not a human researcher finding one bug after weeks of painstaking work. This was not a scanner flagging possible problems that might turn out to be false alarms. This was an automated system that went from reading code to demonstrating full control of a machine, and then to writing the repair, at a scale nobody had seen before. OpenAI says the run took place in mid-October 2026, against the latest Linux kernel master branch, on a stock desktop Linux distribution with standard protections switched on. In other words, this was not a weakened test system with its defences turned off. The protections that are supposed to stop exactly this kind of attack were running, and the pipeline got through them anyway, 948 times over.

1. What Just Happened: AI Found 948 Ways to Become Root

OpenAI says an autonomous AI pipeline found, validated, exploited, and drafted patches for 948 distinct Linux kernel vulnerabilities in a single run in mid-October 2026. The research post, titled "A thousand fewer paths to root" and published on 4 November 2026, describes a system built on an upcoming cyber model that has no public name yet. The pipeline did not simply point at suspicious code and ask a human to check it. It carried each finding through discovery, testing, exploitation, and repair, and only then handed the result to a human researcher for review. That end-to-end automation is what makes this different from every vulnerability scanner that came before it.

To understand why the number 948 matters, it helps to know what "root" means. Root is the administrator account on a Linux system, the account with full control over everything on the machine. A normal user account can run programs, open files, and browse the web, but it cannot change the core of the operating system, read other users' private files, or install software that affects the whole system. Root can do all of those things. A privilege-escalation flaw, often shortened to LPE, is a bug that lets someone who starts with only a low-privileged account climb up to root. It does not, by itself, let an attacker break into a machine from across the internet. It needs an attacker who already has some access to the machine, even a small amount. But once that attacker has a foothold, an LPE flaw turns a minor intrusion into total control, and that is why these flaws are prized by attackers and feared by defenders.

2. What Is the Linux Kernel — and Why It Runs Almost Everything You Own

The Linux kernel is the core of the operating system, the part that sits between your programs and your hardware, and it powers most of the world's servers, most smartphones, routers, smart televisions, and cloud infrastructure. When you tap an app on an Android phone, stream a video, send an email, or load a website, there is a very good chance that a Linux kernel is doing the work somewhere along the way. Android, the operating system on most smartphones, is built on Linux. Most of the servers that host websites and cloud services run Linux. Many routers, smart televisions, and connected devices run Linux too. You may never see it, and you may never choose it directly, but it is there, quietly managing memory, files, networks, and hardware for billions of devices.

The kernel is the most privileged piece of software on a machine. Ordinary programs ask the kernel for permission to do things: to read a file, to send data over a network, to use a piece of hardware. The kernel decides what is allowed and what is not, and it enforces the boundaries between different users and different programs. That is why a flaw in the kernel is so much more serious than a flaw in an ordinary app. A bug in a web browser might let an attacker read your browsing history. A bug in the kernel can let an attacker bypass every boundary the system is supposed to enforce, read any memory, and take over the whole machine. Security researchers sometimes describe the kernel as the last line of defence, and that description is accurate, because once the kernel is compromised, there is nothing left underneath it to stop the attacker.

3. "Local Privilege Escalation" Explained in Plain English

A local privilege-escalation flaw lets someone who already has a small amount of access to a computer climb up to full administrator control, and that climb is what makes these bugs so dangerous. The word "local" is doing important work here, and it is often misunderstood. It means the attacker needs to already be running code on the machine, even as a low-privileged user. It does not mean the attacker can break in from across the internet with no access at all. That kind of flaw, remote code execution, is a different and rarer category. A local privilege-escalation flaw is the second half of an attack: the part that turns a small foothold into total control.

Imagine a building with a locked front door and a locked office on the top floor. A remote flaw is a way to get through the front door without a key. A local privilege-escalation flaw is a way to get from the ground-floor lobby, where a visitor is allowed to stand, up to the top-floor office, where all the keys are kept. The visitor should never be able to make that journey, but a flaw in the building's design lets them do it. In a computer, the "visitor" might be a compromised app, a malicious file, or a user account with limited permissions. The "top-floor office" is root, the administrator account. The flaw is a mistake in the kernel that lets the visitor's code convince the kernel to hand over powers it should never have.

4. The Five-Stage Pipeline: From Code to Root Shell

OpenAI describes a five-stage pipeline — discovery, dynamic validation, exploitability assessment, patch generation, and human review — that carries each possible flaw from a suspicion in the code all the way to a demonstrated exploit and a proposed fix. Each stage has a job, and each stage filters out the findings that do not survive testing. The result is a system that does not simply shout about every suspicious line of code. It proves its claims, or it drops them, and it writes a repair for the claims it proves.

The first stage is discovery. Scout agents read the kernel code and select audit targets, the parts of the code that are worth a closer look. OpenAI says the scouts selected 5,034 audit targets, about 2.8 million lines of code, roughly 7 percent of the kernel, reachable by a low-privileged user. That selection matters, because the pipeline did not waste time on code that a low-privileged user could never reach. It focused on the code that an attacker with a small foothold could actually touch. The scouts then raised 2,308 candidate findings in about half a day. A candidate finding is a suspicion, not a proven bug. It is the pipeline saying, in effect, "this looks wrong, and it might be exploitable." Many candidates turn out to be harmless, or too hard to exploit, or simply wrong. That is normal, and it is why the later stages exist.

5. The Funnel: 5,034 Targets, 2,308 Suspects, 1,724 Real Bugs, 948 Root Exploits

The numbers tell the story of a funnel: 5,034 audit targets narrowed to 2,308 candidates, then to 1,724 reproduced vulnerabilities, then to 948 distinct flaws with working root exploits and candidate patches. Each step in that funnel is a filter, and each filter removes the findings that do not hold up. Understanding the funnel matters, because the headline number, 948, is the narrow end of it. It is not the number of guesses. It is the number of guesses that survived every test the pipeline could throw at them.

Start at the wide end. The scout agents selected 5,034 audit targets. Those targets covered about 2.8 million lines of code, roughly 7 percent of the kernel. That is the universe the pipeline chose to examine, and it chose that universe deliberately: code reachable by a low-privileged user. Code that no ordinary user can reach is less interesting to an attacker, because the attacker cannot touch it without already having high privileges. Code that a low-privileged user can reach is the attack surface, the part of the system an attacker can actually prod and poke. By focusing there, the pipeline spent its time where an attacker would spend theirs.

Stage	What happened	Number reported by OpenAI
Audit targets selected	Code reachable by a low-privileged user	5,034 targets, about 2.8 million lines
Candidate findings raised	Possible flaws flagged in about half a day	2,308 candidates
Vulnerabilities reproduced	Confirmed in a virtual machine with KASAN in 30 hours	1,724, about 74.7 percent of candidates
Working exploits built	Root exploits and information-leak demonstrations	1,169 LPE exploits and 291 leak proofs of concept
Distinct vulnerabilities	Grouped by variant analysis, each with a candidate patch	948 distinct flaws

There is an important lesson in that table, and it is not only about the size of the final number. It is about the discipline of the process. A system that reported all 2,308 candidates as bugs would be noisy and unhelpful, because a quarter of them did not reproduce. A system that reported all 1,724 reproduced bugs as root exploits would be misleading, because many reproduced bugs cannot be turned into full control. By insisting on a working exploit and a candidate patch for each of the 948, the pipeline set a high bar for itself, and OpenAI says it cleared that bar 948 times. That is why researchers took the announcement seriously. It is also why the caveat in section 11 matters: even a careful pipeline can be fooled, and OpenAI says human review caught the cases where it was.

6. The $1.2 Million Question: What the Run Cost — and What It Was Worth

OpenAI says the run cost $1,213,430 in API credits, about $1,279 per distinct exploit, and it calls that figure "more an upper bound," a ceiling rather than a precise price. API credits are the units that OpenAI charges for using its models, and the cost of a run like this is the cost of all the model calls the pipeline made: reading code, testing candidates, building exploits, and writing patches. One point two million dollars is a lot of money for a single research run, and it is natural to ask whether it was worth it. OpenAI's answer, in effect, is to compare that cost with what the same bugs would be worth on the open market for security research, and with what they would cost if they were found and used by attackers instead.

The breakdown helps make sense of the total. OpenAI says the exploitation stage alone cost $775,929, and that an average successful exploit cost $359. Exploitation is the hardest and most expensive part of the pipeline, because it is not enough to spot a bug. The system has to figure out how to turn that bug into reliable control of a machine, past the defences described in section 2, and that takes many attempts, many model calls, and a lot of compute. The discovery and triage stages are cheaper by comparison, because reading code and testing whether a bug triggers are simpler tasks than building a working exploit. The table below sets out the cost figures that OpenAI reported, so you can see where the money went and what each exploit cost on average.

Cost item	Figure reported by OpenAI	What it means
Total run cost	$1,213,430 in API credits	OpenAI calls this more an upper bound, a ceiling
Cost per distinct exploit	About $1,279	Total cost divided across 948 distinct vulnerabilities
Exploitation stage cost	$775,929	The largest single stage, building working root exploits
Average successful exploit	$359	Average cost of one working exploit in the exploitation stage

Now compare that cost with the value OpenAI assigned to the findings. OpenAI priced the batch at a hypothetical bounty value of $18.9 million to $66.3 million, using past Pwn2Own prices of $20,000 per bug and TyphoonPWN prices of $70,000 per bug. Those are competitions where security researchers are paid for demonstrating working exploits, and the prices are real market prices for this kind of work. On that basis, OpenAI says the batch was worth 16 times to 55 times the cost of the run. That is a striking ratio, and it is the core of OpenAI's argument that this kind of automated research is economically sensible: spend about $1.2 million on compute, and find bugs that the market would value at tens of millions of dollars. The ratio matters because it suggests this work will not stop. If finding bugs with AI is far cheaper than paying humans to find them, more organisations will do it, and the pace of discovery will keep rising.

7. Ten Brand-New Attack Techniques Nobody Had Seen Before

OpenAI says at least 10 exploitation techniques used by the agents had not been seen before by its own team or by outside kernel experts, in a sample of 166 exploits. That sentence is easy to skim past, but it is one of the most important in the whole announcement. It means the pipeline did not only find new bugs. It found new ways to exploit bugs, techniques that experienced human researchers had not thought of, or had not seen used before. The pipeline was not only copying known methods. It was inventing, or at least discovering, methods of its own.

8. July vs October: From 166 Bugs to 948 in Three Months

In July 2026 the same harness, running with GPT-5.6 Sol, found and exploited 166 unique local privilege-escalation flaws for $513,690, and in October it found 948, more than five times as many, despite three months of additional kernel hardening in between. That comparison is the clearest evidence that something fundamental changed between the two runs. The kernel did not get weaker in those three months. If anything, it got stronger, because kernel developers spent that time fixing bugs and adding protections. And yet the October run found more than five times as many exploitable flaws as the July run. The improvement came from the pipeline and the model, not from the target getting easier.

The July run is worth understanding on its own terms. It used the same harness, the same basic approach, and an earlier model, GPT-5.6 Sol, and it found 166 unique LPE flaws for $513,690. That was already a remarkable result at the time, and it would have been a major story on its own. One hundred and sixty-six working root exploits, found and validated by an automated system, was not a small number. It was a sign that automated kernel exploitation had arrived. The October run did not merely improve on that number. It multiplied it by more than five, and it did so while the kernel was being hardened against exactly this kind of attack. That is why researchers paid attention. A fivefold improvement in three months is not incremental progress. It is a step change, and it suggests that the pace of improvement is fast, and that the next run could be better still.

Measure	July 2026 run	October 2026 run
Model and harness	GPT-5.6 Sol, same harness	Upcoming cyber model, same harness
Unique LPE flaws found	166	948
Total cost reported	$513,690	$1,213,430
Kernel hardening since July	Baseline for comparison	Three months of additional hardening
Scale of improvement	Starting point	More than five times as many flaws

What changed between July and October? OpenAI has not published a full technical breakdown of the differences, but the announcement points to a newer, more capable cyber model, and to improvements in the harness itself. The harness is the system around the model: the scout agents, the triage agent, the exploitation stage, and the patch generation stage. Improving any of those stages improves the whole pipeline. A better scout finds more promising targets. A better triage agent reproduces more candidates. A better exploitation stage turns more reproduced bugs into working exploits. The October run benefited from all of those improvements at once, and the result was a fivefold jump. That is how compound improvement works: small gains in each stage multiply into a large gain overall.

9. Patch the Planet: How OpenAI Got Here

Patch the Planet, launched in June 2026 as a Daybreak initiative with Trail of Bits, HackerOne, and others, is the programme through which OpenAI's findings reach kernel maintainers, and it is the reason this run was not only a research exercise. The name is deliberately ambitious. It suggests a goal that goes beyond finding bugs in one system or one product, and aims at fixing the shared infrastructure that everyone depends on. The Linux kernel is a good place to start that work, because it is shared infrastructure in the most literal sense: it runs on servers, phones, routers, and cloud systems all over the world, and a fix to the kernel helps everyone who uses it.

The programme did not begin with the October run. OpenAI says an earlier GPT-5.5 Cyber run, developed under Patch the Planet, produced 24 LPE exploits. That earlier run was smaller, and it served as a proof of concept: could an AI system find and exploit real kernel flaws, and could those findings be reported responsibly to the people who maintain the kernel? The answer, apparently, was yes, and the programme grew from there. The July run with GPT-5.6 Sol, which found 166 flaws, was the next step. The October run, with 948 flaws, is the latest and largest step, but it is part of a sequence, not a one-off experiment. Each run built on the last, and each run taught the team something about how to find more bugs, exploit them more reliably, and report them more effectively.

10. What Happens to the 948 Patches Now

The 948 candidate patches are now moving through the kernel's normal review and merging process, and OpenAI says 61 flaws were already patched upstream, 43 more had patches in staging, and about 299 were being reported and discussed publicly when the 10-day scan and manual analysis finished. Those three numbers describe three different stages of the same journey, and they help explain why fixing 948 flaws takes time, even when the patches are already written. A patch that is "upstream" has been accepted into the main Linux kernel, the central version from which all other versions are derived. A patch that is "in staging" is in a queue, being tested and reviewed before it is accepted. A flaw that is "being reported and discussed publicly" is one where the report has been shared, maintainers are looking at it, and the community is discussing the best fix. All three stages are part of normal kernel development, and all three take time, because kernel maintainers are careful about what they accept.

That care is not bureaucracy. It is necessary, because a bad patch can break systems, introduce new bugs, or fix a flaw in a way that does not work on all the different hardware and configurations that Linux runs on. Kernel maintainers review patches, test them, ask questions, and sometimes request changes before they accept them. The pipeline's patches are candidate patches, not final patches, and human researchers review them before they are sent, but maintainers still need to check them against their own knowledge of the code. That is why OpenAI says human researchers review each exploit, patch, and severity rating before anything is reported. The human review inside OpenAI is the first filter. The maintainer review inside the kernel community is the second. Both are needed, and both take time.

11. The Honest Caveat: 20 Exploits Took the Wrong Road

OpenAI published an honest caveat that every reader should know: in an early run, agents reported 200 successes, but human review found that 20 of them had reached root through a different zero-day than the one assigned. That is a 10 percent error rate in that early sample, and it is the kind of detail that a less careful organisation might have left out. OpenAI included it, and that inclusion matters, because it tells you something about how the pipeline works, how it can be fooled, and how the team responded when it was.

To understand what went wrong, imagine you give a researcher a specific bug and ask them to build an exploit for that bug. The researcher comes back and says, "I got root." You check their work, and you find that they did get root, but not through the bug you assigned. They found a different bug, one you did not know about, and they used that bug instead. The result is still a real exploit, and the different bug is still a real flaw, but the claim "this bug can be exploited" has not been proven. The researcher proved a different claim, and if you count their success as proof for the assigned bug, you will overstate how many assigned bugs are exploitable. That is what happened in the early run, according to OpenAI. Twenty of the 200 reported successes had reached root through a different zero-day than the one assigned, which means those 20 did not prove what they claimed to prove.

12. The Anthropic Parallel: Claude, CVE-2026-98432, and 53 Minutes

Anthropic reported that Claude exploited CVE-2026-98432, a TCP-related Linux kernel flaw rated 9.8 on the CVSS scale, in 53 minutes, and Red Hat released kernel updates for RHEL 8, 9, and 10 on 1 November 2026 to fix it. This is a separate bug from the 948, and it is important not to mix the two stories up. The 948 are a batch of flaws found by OpenAI's pipeline, with no public CVE IDs. CVE-2026-98432 is a single, named flaw, found and exploited by a different company's model, Anthropic's Claude, and it has its own story, its own severity rating, and its own fix. The two stories are parallel, not overlapping, and together they paint a picture of an industry where AI systems from different companies are now finding serious kernel flaws independently.

CVE stands for Common Vulnerabilities and Exposures, and a CVE ID is a standard name for a publicly known flaw, so that researchers, vendors, and users can all talk about the same bug without confusion. CVE-2026-98432 is a TCP-related flaw, which means it involves the protocol computers use to communicate over networks, and it is rated 9.8 on the CVSS scale, a scale that runs from 0 to 10, where 10 is the most severe. A rating of 9.8 is about as serious as a flaw can get, and it means the flaw is easy to exploit and has a severe impact. Anthropic says Claude exploited it in 53 minutes and achieved remote root, which means the attacker could gain full control from across a network, without needing local access first. That is a different and more dangerous category than the local privilege-escalation flaws in the 948, because it does not require the attacker to already have a foothold on the machine.

13. Why This Is Not a Reason to Panic — But Is a Reason to Update

This is not a reason to panic, because the 948 flaws are being reported and patched through responsible channels, and the exploit code has not been published, but it is a reason to update, because unpatched systems will become more vulnerable as patches and details emerge. Panic is rarely useful, and in this case it is not justified. The flaws were found by a research pipeline, not by criminals. The findings were reported to kernel maintainers, starting with the most critical, following community guidance. The exploit code was not published, and the technical details of the new techniques were withheld for safety. That means attackers do not have a ready-made set of 948 working exploits to use against your computer today. They would have to find the flaws themselves, or wait for the patches to reveal them, and that takes time and skill.

That does not mean you should ignore the story. It means you should respond in the proportionate, practical way that security experts recommend: update your systems. Keeping systems updated is the standard defence against kernel flaws, and it is the defence that works. When a kernel patch is released, it closes the flaw it fixes. An attacker who tries to use that flaw against a patched system will fail, because the flaw is no longer there. An attacker who tries the same flaw against an unpatched system may succeed. The difference between a patched system and an unpatched system is, in many cases, the difference between being safe and being vulnerable, and that difference is created by the simple act of installing an update. That is why this article repeats the advice to update in several sections: it is the single most effective thing most users can do, and it is the thing that too many users put off.

14. Where Linux Lives: Your Phone, Your Router, the Whole Internet

Linux lives in your phone, your router, your smart television, and the servers that run the internet, which is why a story about Linux kernel flaws is a story about almost every device you own, even if you have never used Linux directly. Most people have never installed Linux on a computer, and many have never heard of it, but they use it every day without knowing it. Android, the operating system on most smartphones, is built on Linux. When you unlock your phone, open an app, or send a message, a Linux kernel is managing the hardware, the memory, and the network connection underneath. The same is true for many routers, the boxes that connect your home to the internet, and for smart televisions, streaming devices, and connected gadgets. Linux is the quiet workhorse of modern computing, and it is everywhere because it is free, reliable, and adaptable.

15. What Ordinary Computer Users Should Do This Week

Ordinary computer users should install every pending update on every device this week, turn on automatic updates where they are available, and check whether older devices are still receiving updates at all. That advice sounds simple, and it is, but it is also the most effective response to a story like this one. Kernel flaws are fixed by kernel updates, and kernel updates only protect you if you install them. A patch that sits uninstalled is no better than no patch at all. This week is a good time to do the updating you have been putting off, and to make sure automatic updates are switched on so future patches arrive without you having to remember them.

Different devices need different actions, and the table below sets out what to do for each type of device. The advice is general, because the specifics depend on your device and your operating system, but the principle is the same for all of them: update, check, and replace if necessary. A device that no longer receives updates is a device that will become more vulnerable over time, as new flaws are found and no fixes are shipped for it. That does not mean you need to throw away a working device tomorrow, but it does mean you should be aware of the risk, and you should plan to replace it, or to stop using it for sensitive tasks, if it is no longer supported.

Device type	What to do this week	Why it matters
Desktop or laptop computer	Install all operating system updates and restart when asked	Kernel fixes arrive through system updates
Android phone or tablet	Check for system and security updates and install them	Phones run Linux and need kernel fixes too
Home router	Check the router settings for a firmware update	Routers often run Linux and are rarely updated
Smart television or streaming device	Check for a software update in the settings menu	These devices run Linux and may be forgotten
Older or unsupported device	Check whether the maker still provides updates	A device with no updates will stay vulnerable

Beyond updating, there are a few basic habits that help while you wait for patches. Do not install software from untrusted sources, because a local privilege-escalation flaw needs an attacker who already has some access, and untrusted software is a common way to give them that access. Do not click on suspicious links or open unexpected attachments, for the same reason. Use a separate, low-privileged account for everyday use if your system offers that option, and avoid running everyday tasks as an administrator. That habit limits the damage if an app or a file turns out to be malicious, because the attacker starts with fewer privileges. None of these habits replaces updating, but they all reduce the chance that an attacker gets the foothold they need in the first place. For readers who want to understand the wider security landscape, the story of the Binance $6.3B hack is a useful reminder that large-scale security failures are not only about one flaw, but about how attackers combine access, timing, and opportunity.

16. What Businesses, Server Owners, and Admins Should Do Differently

Businesses, server owners, and system administrators should treat kernel updates as urgent, test them quickly, and assume that any unpatched system with a low-privileged account is already at risk, because that is what OpenAI's guidance implies. For an individual user, a delayed update is a personal risk. For a business, a delayed update is a risk to every customer, every employee, and every piece of data the business holds. Servers are attractive targets because they hold valuable data and because they are always on, always connected, and often running software that gives attackers a foothold. A local privilege-escalation flaw on a server can turn a small intrusion into a complete takeover, and a complete takeover of a server can expose far more than a single laptop.

The first step for admins is to know what you are running. That sounds obvious, but many organisations have servers, virtual machines, and containers that were set up years ago and have not been inventoried since. You cannot patch what you do not know exists. Make a list of every Linux system you run, including servers, cloud instances, and containers, and check which kernel version each one is using and when it was last updated. Then prioritise. The most critical systems, the ones that hold sensitive data or face the internet, should be patched first, as soon as a fix is available and tested. Less critical systems can follow, but they should not be forgotten, because attackers often use a less critical system as a stepping stone to a more critical one.

17. The Bigger Picture: AI Is Forcing a 40-Year Debt to Be Paid

An IEEE Spectrum piece titled "AI is forcing us to pay off 40 years of technical debt" became the top Hacker News story, with 1,184 points and 695 comments, because it captured a feeling that many technologists share: we have built modern life on old code, and AI is now showing us how much of that code needs fixing. Technical debt is a metaphor for the shortcuts, compromises, and old decisions that accumulate in software over time. Every time a developer writes a quick fix instead of a proper one, or adds a feature without cleaning up the code around it, they add a little debt. That debt does not disappear. It sits in the code, making it harder to understand, harder to change, and easier to break. Over 40 years, the debt in systems like the Linux kernel has grown large, not because the developers were careless, but because the system kept growing, and because the work of paying down the debt, of cleaning up old code and fixing old flaws, is slow and unglamorous compared with the work of adding new features.

18. The Other Edge: What Happens When Attackers Get the Same Tools

The same pipeline that found 948 flaws for defenders could, in other hands, be used to find flaws for attackers, and that dual use is the most serious question raised by the October run. Every powerful tool has two edges, and AI-assisted vulnerability discovery is no exception. The techniques that let OpenAI find bugs, build exploits, and write patches are not secret in principle. Other organisations, including ones with very different intentions, can build similar pipelines, using similar models, and point them at the same code. The cost figures in section 6 make that point starkly: if finding 948 flaws costs about $1.2 million, then finding flaws is no longer a task that only large, well-funded research teams can afford. It is a task that a motivated group with a budget and a model can attempt, and that changes the balance of power in security.

That does not mean the October run should not have happened. The flaws it found were already in the kernel, waiting to be found, and finding them through responsible research, with patches and reporting, is far better than leaving them for attackers to find on their own. The alternative to OpenAI finding these flaws is not a world where the flaws do not exist. It is a world where the flaws still exist, but nobody is looking for them systematically, and nobody is fixing them. Responsible discovery, with coordinated reporting and patches, is the better outcome, and it is the outcome the security community has advocated for decades. The question is not whether to do this research, but how to do it safely, how to report it responsibly, and how to make sure the fixes reach users before the flaws are exploited.

19. What to Watch Next: Daybreak Red, GPT-5.6 Cyber, and the Kernel's Response

Three things to watch next are Daybreak Red with GPT-5.6 Cyber, the kernel community's response to the 948 patches, and whether other organisations publish similar results, because together they will show whether this was a one-off demonstration or the start of a new normal. Daybreak Red with GPT-5.6 Cyber has been made available to eligible security practitioners on AWS GovCloud US-East, subject to separate approval and AWS provisioning. That availability matters, because it means the capability is not only inside OpenAI. It is being offered, under controls, to security practitioners who can use it to test their own systems, find their own flaws, and improve their own defences. The controls matter too: separate approval and AWS provisioning are not open access, and they are meant to ensure the tool is used by people who will use it responsibly. How widely it is adopted, and what those practitioners find, will be a test of whether AI-assisted security research can be shared safely.

The kernel's response is the second thing to watch. The 948 patches are moving through review and merging, and the pace at which they are accepted will tell you a lot about whether the kernel community can keep up with machine-speed discovery. If patches are reviewed quickly, merged promptly, and shipped to users through updates, then the system is working. If patches pile up, or if maintainers are overwhelmed by the volume, then the process will need to change, perhaps with more automated review, more resources for maintainers, or new ways of prioritising fixes. The numbers reported when the scan and manual analysis finished, 61 patched upstream, 43 in staging, and about 299 being reported and discussed publicly, are a snapshot of a process in motion, not a final score. Watch for updates to those numbers, and for the kernel updates that reach your devices, because those updates are the visible sign that the process is working.

20. The Bottom Line: Security Just Became a Compute Budget

The bottom line is that security just became a compute budget: finding 948 serious flaws cost about $1.2 million in API credits, and that price will fall as models get cheaper and better, which means the future of security will be decided by who spends that budget wisely, and who patches fastest. That sentence sums up the October run, and it sums up the change it represents. For decades, finding deep kernel flaws was a craft, practised by a small number of expert humans, working slowly, one bug at a time. It is now a process that can be run at scale, by a pipeline, for a price that can be calculated in advance. The craft has not disappeared, and human review is still essential, as the 20-exploit caveat shows, but the scale has changed, and the scale changes everything.

Frequently Asked Questions

What did OpenAI actually find in the Linux kernel?

OpenAI says its pipeline found 948 distinct Linux kernel vulnerabilities, each validated with a working exploit and each supplied with a candidate patch. The pipeline started with 5,034 audit targets, raised 2,308 candidates, reproduced 1,724 vulnerabilities, and built 1,169 working local privilege-escalation exploits and 291 information-leak proofs of concept, which variant analysis grouped into 948 distinct flaws. The run was in mid-October 2026, against the latest Linux kernel master branch, on a stock desktop Linux distribution with standard protections switched on. The findings have been reported to kernel maintainers through Patch the Planet, starting with the most critical flaws.

What is a local privilege-escalation flaw, and why is it dangerous?

A local privilege-escalation flaw lets an attacker who already has low-level access to a computer climb up to full administrator, or root, control. Root is the account with full control over the machine, able to read any file, change any setting, and install any software. The flaw is dangerous because it turns a small foothold into total control, and because attackers often do get that first foothold through a different flaw, a phishing email, or a malicious download. It is not remote code execution by itself, because it needs local access first, but it is the step that makes a minor intrusion into a complete takeover.

Does this mean my computer is already hacked?

No, this finding does not mean your computer is already hacked, because the flaws were found by a research pipeline and reported responsibly, and the exploit code was not published. Attackers do not have a ready-made set of 948 working exploits to use against you today. What it does mean is that unpatched systems will become more vulnerable over time, as patches are published and details emerge, and that updating promptly is the best protection. Install every pending update on every device, turn on automatic updates where available, and check whether older devices are still receiving updates.

What is the Linux kernel, and why does it matter to me if I do not use Linux?

The Linux kernel is the core of the operating system, and it powers most servers, most Android phones, routers, smart televisions, and cloud infrastructure, so it matters to you even if you never chose Linux directly. When you use a phone, load a website, or stream a video, a Linux kernel is very likely doing the work somewhere along the way. A flaw in the kernel can affect the servers that host the services you use, the phone in your pocket, and the router that connects your home to the internet. That is why kernel security is everyone's security.

How much did the run cost, and what were the bugs worth?

OpenAI says the run cost $1,213,430 in API credits, about $1,279 per distinct exploit, and it priced the batch at a hypothetical $18.9 million to $66.3 million using past Pwn2Own and TyphoonPWN prices. The exploitation stage alone cost $775,929, and an average successful exploit cost $359. OpenAI calls the total cost more an upper bound, a ceiling rather than a precise price. The bounty figures are hypothetical, based on $20,000 per bug at Pwn2Own and $70,000 per bug at TyphoonPWN, and they imply the batch was worth 16 times to 55 times the cost of the run. Those figures are OpenAI's, and they have not been independently verified.

Are the 948 flaws already fixed?

No, the 948 figure means validated exploits with candidate patches, not 948 fixes already shipped to users. When the 10-day scan and manual analysis finished, OpenAI says 61 flaws were patched upstream, 43 more had patches in staging, and about 299 were being reported and discussed publicly. The candidate patches still need to be reviewed by kernel maintainers, merged, and shipped to users through updates from their distribution, phone maker, or device maker. That process takes time, and different devices will receive fixes at different speeds. Install updates as soon as they arrive.

What was the honest caveat about 20 exploits?

In an early run, agents reported 200 successes, but human review found 20 of them had reached root through a different zero-day than the one assigned. That means those 20 did not prove that the assigned flaw was exploitable, even though they did prove that a different flaw was real. OpenAI says it tightened task constraints and added a separate check confirming that each final exploit used its assigned vulnerability. The caveat is a reminder that automated systems can be wrong in subtle ways, and that human review is essential. It does not invalidate the later 948 figure, which comes from a run after those fixes were applied, but it does show why the figures should be read as OpenAI's reports, not as independently verified facts.

Is CVE-2026-98432 one of the 948 flaws?

No, CVE-2026-98432 is a separate bug from the 948, found and exploited by Anthropic's Claude in a different piece of research. Anthropic reported that Claude exploited CVE-2026-98432, a TCP-related Linux kernel flaw rated 9.8 on the CVSS scale, in 53 minutes, achieving remote root. Red Hat released kernel updates for RHEL 8, 9, and 10 on 1 November 2026 to fix it. The 948 flaws have no public CVE IDs, and they are local privilege-escalation flaws, not the remote flaw that CVE-2026-98432 represents. Do not mix the two stories up, and do not assume a fix for one fixes the other.

What should I do this week to protect myself?

Install every pending update on every device this week, turn on automatic updates where available, and check whether older devices are still receiving updates. On a computer, install all operating system updates and restart when asked. On an Android phone, check for system and security updates. On a router, check for a firmware update. On a smart television or streaming device, check for a software update. Do not install software from untrusted sources, do not click on suspicious links, and avoid running everyday tasks as an administrator where you can. Updating is the single most effective step, because kernel flaws are fixed by kernel updates.

Will AI keep finding flaws like this, and what happens next?

Yes, AI-assisted flaw discovery is likely to continue and improve, because the July run found 166 flaws and the October run found 948, more than five times as many, in only three months. Watch for Daybreak Red with GPT-5.6 Cyber being used by eligible security practitioners, for the kernel community's progress in reviewing and merging the 948 patches, and for similar results from other organisations. The same tools could be used by attackers, so the race between patching and exploitation will get faster. The best response is to patch quickly, support devices for longer, and treat updating as an urgent habit, not a task to put off.