On November 4, 2026, OpenAI announced that a prototype AI system had demonstrated 948 local privilege escalation vulnerabilities in the Linux kernel and drafted a fix for each. The research targeted development code as of mid-October and ran vulnerability discovery, exploit-based validation, and patch generation as a single pipeline.
Local privilege escalation is an attack in which a low-privileged user who can run programs on a system illegally obtains administrator (root) privileges. Unlike a remote attack, which can break in directly from outside, it generally requires the attacker to be able to execute code on the target system. Demonstrating an attack is also a separate matter from the flaw being fixed and the fix reaching users' environments. To evaluate this result, it is necessary to look beyond the figure of 948 and distinguish the time spent on validation and the adoption status of the patches.
How were the 948 vulnerabilities found and demonstrated?
The study focused on code reachable by low-privileged users, analyzing about 2.8 million lines within 5,034 audit targets. This corresponds to roughly 7% of the Linux kernel, so the results do not come from a comprehensive survey of the whole kernel. First, an AI agent called "Analyst," which handles vulnerability discovery, extracted 2,308 deduplicated candidates in 12 hours.
Next, the team used isolated virtual machines (VMs) with KASAN (Kernel Address Sanitizer), a tool that detects memory-related bugs, to check whether the candidate issues could actually be reproduced. OpenAI itself stresses that issues reported as candidates are not the same as vulnerabilities that were actually validated. In other words, the AI merely flagging suspicious code did not mean every flag was counted as a real vulnerability.
The results are organized by stage below. What matters is that each stage counts a different kind of item. The 30-hour figure also refers to the time spent on dynamic validation, which differs from the total period of the investigation, including human analysis.
| Stage | Count | Time / validation conditions | Description |
|---|---|---|---|
| Vulnerability discovery | 2,308 candidates | 12 hours | Deduplicated vulnerability candidates |
| Dynamic validation | 1,724 reproduced | Within 30 hours, isolated VMs with KASAN enabled | Problems confirmed through actual execution |
| Exploit demonstration | 1,169 exploits | VMs with the defenses of standard Linux distributions enabled | Exploits that successfully obtained root privileges |
| Variant analysis and consolidation | 948 privilege escalation vulnerabilities | Organized based on 948 distinct fixes | Count after analyzing and consolidating variants of the same problem |
These results are based on an investigation OpenAI carried out in mid-October, and it took 10 days to complete the autonomous scanning and the human analysis.
Of the 2,308 candidates initially extracted, 1,724 were actually reproduced, a rate of about 74.7%. However, factors such as execution privilege requirements, race conditions, and validation time limits can affect candidates that could not be reproduced, so the remainder cannot all be written off as false positives. Further validation of exploitability produced 1,169 exploits that successfully obtained root privileges, and after variants of the same problem were consolidated, the final count came to 948.
Alongside the privilege escalation flaws, the process also demonstrated 291 information leaks. The work went beyond simply finding bugs to verifying what kinds of attacks they could lead to. Succeeding in an environment with the defenses of common Linux distributions enabled is noteworthy, but it does not mean every Linux environment is equally affected. The impact on individual distributions and the status of fix distribution also cannot be judged from these counts alone.
In June 2026, OpenAI also used GPT-5.5 Cyber to demonstrate 24 vulnerabilities, and an investigation with GPT-5.6 Sol in late July raised the number to 166. This time, the scope expanded beyond discovery and dynamic validation to include patch generation, and the October investigation used a cybersecurity-focused model scheduled for future release as its core. However, because each investigation targeted different kernel development code, the increase in the number of discoveries cannot be taken directly as the rate of improvement in AI model performance. The API cost for the entire investigation was $1,213,430, which does not include total costs such as labor and equipment.
Obtaining root does not necessarily mean the designated vulnerability was exploited
The study also uncovered problems with how attacks were validated. In the initial runs, 20 of the 200 attacks judged successful had obtained root privileges through a different zero-day vulnerability rather than the designated one. If the only goal given to the AI is to obtain root privileges, exploiting a vulnerability other than the one under investigation still meets the success condition. Even though the attack itself succeeded, it did not prove that the designated vulnerability was exploitable.
This problem also affects verifying whether a fix works. Even if the designated vulnerability is fixed, if the validation exploit is abusing a different vulnerability, the success or failure of that exploit alone cannot show whether the fix is correct. In response, OpenAI tightened its validation conditions and added a step to independently confirm that the designated vulnerability is actually being used. Note that the figure of 20 out of 200 reflects a problem identified at an early stage and does not indicate the error rate of the final 948.
The quality of the patches was also an issue. Early fixes included some with changes that were too broad, some with performance concerns, and some that did not follow Linux kernel development conventions. In some cases, even when the direct cause of a problem was fixed, other variants of the same vulnerability were missed. Even if the immediate attack is blocked, the problem is not fundamentally resolved if similar paths remain.
OpenAI explains that additional instructions and iterative revision improved these problems. However, better patch quality is not the same as all of them being adopted by Linux kernel maintainers. The company has adopted a procedure in which humans review the AI-created exploits and patches, evaluate severity, and then report to maintainers. Even if AI can speed up vulnerability discovery and attack demonstration, the steps of identifying causes and confirming that fixes are appropriate cannot be skipped.
How far have the 948 fixes reached real Linux environments?
By the time the 10 days of autonomous scanning and human analysis were complete, according to OpenAI, 61 issues had been fixed in upstream code, patches for 43 were being prepared for inclusion, and 299 were at the stage of public reporting and discussion. However, this is the situation at a specific point during the research, not the latest fix status as of November 5. Nor can this breakdown alone be used to calculate how many of the 948 remain unfixed today.
OpenAI says it has prioritized serious problems and submitted several hundred vulnerability reports and patches, and is reporting the rest in stages in coordination with its partners. If AI causes the number of discovered vulnerabilities to surge, the burden on the maintainers receiving the reports also grows. They have to confirm the cause of each reported problem, verify whether it reproduces in the latest code, and review appropriate fixes, all at the same time. To measure defensive results, what matters is not just the number of patches the AI generates but also the number of fixes that are actually adopted, distributed, and confirmed effective in target environments.
The Hacker News also covered the research as an example of the changes AI brings to both attackers and defenders, noting the importance of organizations having systems to verify and apply vulnerability fixes. In addition, a report published on November 3 by the UK's National Cyber Security Centre (NCSC) presents three scenarios for 2028 on how AI may change cyberattacks and defense.
However, the NCSC clearly positions these scenarios as "not predictions." Its point that AI will accelerate patch creation while organizations will also need to rethink how they test and apply fixes is a future assumption within the baseline scenario. It does not describe a change that has already been measured, nor is it an independent verification of the 948 vulnerabilities OpenAI reported.
The vulnerability counts and API cost in this study are based on OpenAI's own reporting, and there has been no confirmation of independent replication by third parties or of the completion of audits of all the patches. Even so, showing that AI can drive vulnerability discovery, attack demonstration, and patch generation at scale is a significant achievement. The focus going forward is likely to shift from how many vulnerabilities AI can find to whether those results can be incorporated as official Linux kernel fixes and delivered safely and quickly to users' environments.