Analysis · AI Security · 6 November 2026

$1,280 per root: AI just put a price on a Linux kernel exploit

OpenAI’s October run produced 948 unique Linux privilege-escalation vulnerabilities for $1.2 million. Divide one by the other and vulnerability discovery has a unit price for the first time — which changes what it costs to defend, patch and maintain software.

By Kati Vamshi · 6 min read · Updated 6 November 2026

The figure OpenAI published on 4 November is easy to skim past. In a mid-October run, its autonomous vulnerability pipeline identified 2,308 candidate findings in the Linux kernel, dynamically reproduced 1,724 of them, and produced 291 information-leak proofs of concept alongside 1,169 working local privilege-escalation exploits. After variant analysis, it settled on 948 distinct vulnerabilities, and wrote patches for each.

The run cost $1,213,430 in API credits.

Divide one by the other and you get a number that did not exist a year ago: about $1,280 per unique Linux root exploit, found, weaponised and patched, end to end, by a machine.

OpenAI’s own post makes the comparison explicit. A late-July run with GPT-5.6 Sol produced 166 unique LPEs for $513,690 — $3,095 each. Between July and October the cost of a kernel privilege-escalation bug fell 58.6%, while the number produced rose 5.7 times, against what the company describes as three months of hardening in between.

That is the story. Not a benchmark position, not a leaderboard. A price.

Where the $1.2 million actually went

Most coverage of this run reports the headline figure and the per-exploit average. The stage breakdown is more useful, because it tells you which part of the job is still expensive — and it is not the part most people assume.

Pipeline stage	API cost	Share of total
Scout agents	$3,426	0.3%
Candidate discovery	$316,549	26.1%
Initial screening	$44,194	3.6%
Validation	$73,330	6.0%
Exploitation	$775,929	63.9%
Total	$1,213,430	100%

Source: OpenAI, “A thousand fewer paths to root”, 4 November 2026. Stage figures sum to $1,213,428; the $2 difference is rounding in the original.

Exploitation is 64% of the bill. Finding candidate bugs — the part everyone assumes is the hard problem — is only 26%.

The breakdown inside that 64% is the genuinely under-reported finding. Successful exploits averaged $359 each. The 69 unsuccessful exploitation attempts averaged $3,922 each, roughly eleven times more. The expensive part of automated exploitation is not succeeding; it is failing slowly against targets that resist. A pipeline with a better give-up rule would cut its own bill by a large fraction without finding a single additional bug.

That is a scheduling and budget-allocation insight, and it is available to anyone running this kind of system — which, given the costs involved, is a short list.

The funnel, priced per unit

The same $1,213,430 divided at each stage of the funnel gives the cost of a finding, a reproduced vulnerability, a working exploit, and a distinct root-level bug. This is our calculation from the counts OpenAI reports.

Stage of the funnel	Count	Cost per unit	Survives to next stage
Candidate findings	2,308	$526	74.7%
Dynamically reproduced	1,724	$704	67.8%
Working LPE exploits	1,169	$1,038	81.1%
Unique LPEs (after variant analysis)	948	$1,280	—

Our analysis. Counts from OpenAI’s published pipeline figures; cost per unit is the reported total divided by each stage count.

Method

Total API spend of $1,213,430 was divided by each reported stage count: 2,308 candidate findings, 1,724 dynamically reproduced vulnerabilities, 1,169 working LPE exploits and 948 unique LPEs after variant analysis. Stage-to-stage retention is the later count divided by the earlier one. Costs are stated as API credits, which OpenAI describes as an upper bound on the cost of running an equivalent pipeline.

Read the last column first. Three quarters of candidate findings survive dynamic reproduction, which is high for static analysis. Two thirds of reproduced vulnerabilities convert into a working exploit. Four fifths of working exploits collapse into a distinct bug once variants are merged. The pipeline’s weakest link is not precision at the front — it is duplication at the back, which is a bookkeeping problem, not a research one.

The 16x-to-55x number, and why to hold it loosely

OpenAI values the 948 exploits against historical bounties: $20,000 at Pwn2Own and $70,000 at TyphoonPWN for a Linux kernel LPE. Multiply out and you get $18.9 million to $66.3 million — 16 to 55 times the cost of the run.

It is a striking multiple and it should be handled carefully. Those bounties price a single exploit against a hardened, fully patched target, under competition conditions, judged by humans, with disclosure obligations and a legal framework attached. The pipeline’s 948 are unverified by anyone outside OpenAI. Comparing a paid, adjudicated bounty to an internal count is comparing a retail price with a wholesale estimate. The direction of the gap is almost certainly right. The magnitude is soft.

What it does to open source

Here is the asymmetry that matters. The cost of finding a vulnerability has fallen by more than half in a quarter. The cost of fixing one has not moved at all, because fixing is human review, deduplication, a patch that survives review, and a backport to every stable branch still in use.

OpenAI reports that during its 10-day run, more than 100 Linux LPEs were patched or had staging patches from other contributors, with roughly 300 more under public discussion. By the end of its own analysis, 61 of the bugs it found were already patched upstream, 43 had staging patches, and 299 were being reported and discussed.

So the bottleneck has moved. It is no longer “can anyone find it” — that question now has a price and a supplier. It is “who reviews, deduplicates, patches and backports 948 reports in a fortnight”, and that work is done by a small number of maintainers, often unpaid, for software that runs most of the internet.

A model that finds bugs 5.7 times faster than it did in July is a gift to maintainers only if the patch pipeline scales with it. Nothing in this announcement suggests that it does.

OpenAI’s own conclusion is the uncomfortable one: audited code has to be re-scanned as models improve, because a better model finds what the earlier one missed. That converts patching from a project into a subscription, and the subscription is paid in maintainer hours.

The other side of the ledger

There is a reading of this that is straightforwardly good news. On a hardened kernelCTF target the pipeline found 21 LPEs in 112 hours for $32,936 — about $1,568 per exploit. Twenty-six confirmed zero-day LPEs were accepted by kernelCTF across all of 2026. One run, in under five days, for less than a mid-size company’s annual security tooling budget, matched four fifths of a year’s global output for that programme.

For a defender, that is a tool that costs less than the incident it prevents. Which is precisely why OpenAI is shipping it narrowly: GPT-6 Cyber is rated Critical under its Preparedness Framework and released only to vetted customers in its Daybreak Red programme, with blocks on high-risk activity including attacks on power plants and water treatment facilities. The same capability, in less careful hands, is the other half of the story.

What is not established

This is a company reporting on its own system, and the caveats are substantial. No independent party has reproduced the 948. The model is unreleased and described only as an upcoming cyber model. The target was a single unnamed stock desktop Linux distribution — no servers, no custom kernels, no hardened configurations. The 948 is a count of distinct patches, not of merged fixes. Privilege escalation requires local access first; none of this is remote code execution. OpenAI describes its own costs as an upper bound. And the claim of ten novel exploitation techniques in a sample of 166 cannot be checked at all, because the details were withheld.

What to do about it

Four things follow, and none of them require buying anything.

1. Assume local access is root, and design accordingly. If a low-privileged account on a shared host is one model release away from kernel escalation, the container boundary is your real security perimeter.
2. Move your patch cadence from quarterly to monthly. The finding rate has changed by 5.7 times in a quarter; a 90-day window now contains several model generations.
3. Re-scan your audited code every time a frontier cyber model ships. Your clean bill of health from July is not a clean bill of health in November.
4. Budget for triage, not just detection. The scarce resource is now the human who decides which of 948 findings to fix first.

The interesting question was never whether a model could find a kernel bug. It is what happens to the maintenance economy of open source when finding one costs $1,280 and fixing one costs a volunteer a weekend.

Sources

OpenAI, “A thousand fewer paths to root”, 4 November 2026. openai.com/index/a-thousand-fewer-paths-to-root/

The Verge, Emma Roth, “OpenAI says its new cybersecurity model is better at not hacking other companies”, 5 November 2026. theverge.com

DeepLearning.AI, The Batch, issue 378, 6 November 2026. deeplearning.ai/the-batch/issue-378

Disclosure: this article was drafted with AI assistance under [your publication]’s editorial standards and checked line by line against the primary sources above. Every figure in both tables is either taken directly from OpenAI’s published breakdown or derived from it by the stated method.