OpenAI wants automated security research to keep pace with models that can find bugs faster than humans can triage them. In a November 4, 2026 post titled "A thousand fewer paths to root," the company described an autonomous pipeline for vulnerability discovery, validation, exploitability assessment and patch generation aimed at the Linux kernel, which it calls out as critical infrastructure for phones, cloud servers and much of the internet.
In a mid-October 2026 run using an upcoming cyber-focused model, OpenAI says the pipeline analyzed 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 working local privilege-escalation exploits for a commonly used Linux distribution running with standard protections enabled. The company puts the full run at $1,213,430 in API credits, or about $1,279 per privilege-escalation exploit. Each packaged result, OpenAI says, includes a root-cause analysis, a minimal crashing proof of concept, a candidate patch and a full exploit so human researchers can judge severity before anything is reported upstream.
The pipeline is organized in five stages: scout and analyst agents narrow the kernel to security-relevant audit targets, triage agents reproduce candidates in isolated virtual machines, exploit-development agents test whether a finding can leak information or escalate privileges, patch-generation agents propose fixes, and human security researchers review the package before reporting. OpenAI says scout agents cut the audit surface to about 2.8 million lines of code — roughly 7% of the kernel — and that only about 3.1% of candidate findings reflected incorrect analysis by the model.
OpenAI frames the work as an expansion of its Patch the Planet effort. In June it said GPT-5.5 Cyber had produced 24 local privilege-escalation exploits; a late-July run with GPT-5.6 Sol found 166 unique ones. The mid-October cyber-model run found more than five times as many novel privilege-escalation bugs as that July scan, OpenAI says, even after three months of hardening between the two. The company also says agents used at least 10 novel exploitation techniques in a sampled set of exploits, details of which it is withholding for safety.
Cost and urgency sit at the center of the argument. Applying historical Pwn2Own and TyphoonPWN bounty figures of $20,000 and $70,000 to the 948 exploits yields a hypothetical valuation of about $18.9 million to $66.3 million — roughly 16x to 55x the pipeline's API cost, OpenAI calculates. On an adapted kernelCTF setup, the same pipeline produced 21 local privilege-escalation exploits for about $32,936 in credits. During the ten days of the main scan, OpenAI says it saw more than 100 Linux privilege-escalation flaws already patched or given staging patches by other contributors, with hundreds more under public discussion.
Independent coverage from The Hacker News and Phoronix matches the headline numbers and the five-stage structure from OpenAI's post. OpenAI's takeaway for operators is blunt: for the near and medium term, a low-privileged account on an unpatched system should be treated as functionally equivalent to root for a well-resourced attacker, so defense in depth and keeping systems current matter as much as finding the next bug. The company says it has already sent hundreds of critical reports and patches and is working with Patch the Planet partners on the rest — with human review still required before anything reaches maintainers.