OpenAI used AI to find nearly 1,000 ways for hackers to hijack Linux

Published Nov 5, 2026, 2:29 PM EST Jefferson Mangubat is an experienced technology journalist who has reported on consumer electronics, software updates and big stories in the industry. He's now a Reporter at How-To Geek, and has built a solid reputation for delivering accurate, accessible, and insightful tech journalism. Prior to that, he was a tech reporter for Neowin, where he extensively covered hardware developments from Apple and Google, in addition to digital trends and application updates. OpenAI has been steadily building its AI-powered cybersecurity efforts, first with Aardvark in 2025, and then with Codex Security and its Patch the Planet initiative in 2026. Previous experiments on Linux kernel security uncovered hundreds of possible vulnerabilities. Now OpenAI has taken that research a step further, revealing that its latest automated pipeline has discovered 948 Linux kernel vulnerabilities that could enable attackers to obtain root access. AI agents found more than 2,300 potential security issues OpenAI’s automated pipeline goes beyond traditional vulnerability scanning The research, published on November 4, outlines an automated pipeline for finding, exploiting, and patching vulnerabilities, powered by a forthcoming AI model for cybersecurity. Rather than having researchers manually inspect individual kernel sections, the system breaks the process into five stages: vulnerability discovery, dynamic validation, exploitability assessment, patch generation, and human review. In a mid-October 2026 research run, OpenAI’s AI-powered pipeline discovered 2,308 candidate Linux kernel vulnerabilities, 1,724 of which were successfully reproduced. It also produced 948 working local privilege escalation (LPE) exploits. It also made proof-of-concept demonstrations for 291 vulnerabilities in information disclosure. The whole run took about 30 hours and cost $1,213,430 in API credits, or about $1,279 per LPE exploit on average. These are not remote exploits you can run against any Linux box on the internet. LPE vulnerabilities normally require the attacker to already have some local access before they can exploit weaknesses to gain root privileges. Still, that’s a serious problem for shared systems and machines running untrusted workloads. The agents have also discovered at least 10 new exploitation techniques, including kernel memory manipulation, page grooming, data-only attacks, and type confusion, according to the company. Those techniques could make it easier to exploit certain kernel weaknesses, giving maintainers another reason to take AI-assisted vulnerability research seriously. Linux maintainers still have the final word Finding vulnerabilities is just half the battle The research isn’t just about finding new ways into Linux systems. OpenAI says it also wants to shorten the gap between finding a vulnerability and fixing it. Its pipeline produces candidate patches and technical evidence, such as root-cause analysis and proof-of-concept exploits. The human security researchers then review the findings and report them to the maintainers. The company also tested its system against the hardened kernelCTF environment from Google. The experiment generated 25 information disclosure proof of concepts and 21 LPE exploits in 112 hours and cost about $32,936 in API credits. Those findings, if accepted, could represent around $1.5 million in potential bug bounty payouts, estimates OpenAI. OpenAI said it has started to report critical vulnerabilities and is collaborating with members of the Linux kernel community and Patch the Planet partners on further disclosures and fixes. That doesn’t mean all 948 vulnerabilities have been patched or rolled into Linux releases. The bigger problem is that attackers can also employ increasingly capable AI tools. OpenAI argues that defenders need automated patch generation to keep pace with automated vulnerability discovery. For Linux users, the situation makes timely kernel updates and security maintenance all the more important. AI could make it cheaper to discover vulnerabilities, but it could also make it a whole lot more expensive to leave them unpatched. Source: OpenAI