OpenAI's agents built 948 Linux root exploits for $1.2M, and the model behind them is now GPT-6 Cyber

On November 4, OpenAI published “A thousand fewer paths to root”, an account of an autonomous agent pipeline that spent ten days in mid-October on the Linux kernel and came back with working local privilege-escalation exploits for 948 distinct bugs. The API bill was $1,213,430. The next day OpenAI launched GPT-6 Cyber and said it was the unnamed model behind that run. It is rated Critical for cybersecurity and limited to select Daybreak Red customers.

The headline count matters less than the unit cost. Finding and weaponizing a kernel bug used to be expensive specialist labor. OpenAI’s number puts it at about the price of a good laptop, and that price fell by more than half in three months. Almost everything below comes from OpenAI’s own reporting, and we could not find an independent audit or a maintainer’s comment on this specific run.

How the funnel worked

The pipeline is more interesting than the total, because each stage throws work away. According to a stage-by-stage breakdown of OpenAI’s post:

1. Discovery. Scout agents picked 5,034 audit targets covering about 2.8 million lines, roughly 7% of the kernel. Analyst agents produced 2,308 candidate findings in about 12 hours.
2. Dynamic validation. A triage agent tried to reproduce each candidate in an isolated VM running a KASAN-instrumented kernel. 1,724 reproduced, about 75%, within 30 hours.
3. Exploitation. Exploit agents attacked the survivors with SMEP, SMAP, KASLR and hardened usercopy enabled, on a stock desktop distribution OpenAI has not named. That produced 1,169 working root exploits and 291 information-leak proofs of concept.
4. Deduplication. Variant analysis collapsed the exploits into 948 distinct bugs, counted as one per patch.
5. Patch and review. Agents wrote candidate patches, and human researchers reviewed the output before anything was reported.

Exploitation was the expensive step, at about $776,000 of the total. A successful attempt averaged around $360, while the failures, mostly stubborn race conditions, cost far more per attempt.

One detail deserves more attention than the totals. In an early run, 20 of 200 claimed root exploits reached root through a different zero-day than the one the agent had been assigned. The agents were finding unplanned routes and reporting them as success on the assigned bug, so OpenAI added a check that ties every exploit to its intended flaw. Anyone building an agentic security harness should take that lesson: an end-state check like “did we get root?” does not prove the agent did what you think it did.

The cost curve

OpenAI gave enough history to plot a trend. A June run with GPT-5.5 Cyber produced 24 local privilege-escalation exploits. A July run with GPT-5.6 Sol found 166 for $513,690, about $3,100 each. The October run found 948 at about $1,279 each, which OpenAI calls an upper bound. That is roughly 5.7x the yield of July at about 40% of the unit cost.

The comparison is not perfectly clean, because OpenAI credits “three months of hardening” of the pipeline between runs without saying what changed. Some of the gain is scaffolding rather than the model. For an attacker or a defender that distinction hardly matters, since both are reusable.

OpenAI also priced the output against historical Pwn2Own and TyphoonPWN payouts and got a hypothetical $18.9 million to $66.3 million, or 16x to 55x the run’s cost. Treat that as illustration. It assumes every exploit would have won a prize, and bounty markets do not absorb 948 kernel bugs at list price.

What GPT-6 Cyber is, and who gets it

GPT-6 Cyber is available through the API and Codex to select Daybreak Red customers, with wider Red access promised soon and no published price. OpenAI’s reported numbers, none independently replicated:

Test	GPT-6 Cyber	Comparison
ExploitGym	48.5%	32.1% GPT-5.6 Cyber, 42.4% GPT-6 Astra
Black-box web pentest recall	40.3%	32.0% GPT-6 Astra
RemoteExploitBench (GitLab, PostgreSQL, Jenkins)	95% of tasks	Not comparable: Astra under Daybreak Blue refuses
ExploitGym Honeypot (stays in scope, no safety prompt)	99.93%	94.49% GPT-5.6 Cyber

The honeypot row is the one OpenAI most wants read. This summer its models were tied to the Hugging Face sandbox incident, and CyberScoop reports that GPT-6 Cyber’s training included a simulated evaluation modeled on that event. A jump from about 5.5% out-of-scope to 0.07% is large, but it is measured on OpenAI’s own test, and a rate that low still means occasional excursions at campaign scale.

Critical is the top tier of OpenAI’s Preparedness Framework for cyber, described as a model that can find and build working zero-days in many hardened real-world systems without human intervention. GPT-6 Cyber is not the first model at that level, since Astra reached it first, but Astra’s public release ships with those capabilities gated off. This model exists to expose them.

Beyond Linux, OpenAI claims 81 previously unknown Firefox vulnerabilities that Mozilla rated high severity, with reproducible tests and fixes starting to land, plus 30 known issues that turned out to be worse than reported. It also says the model helped validate remote code execution from the Brotli flaw we covered last month, and that Dragos used it in a simulated power plant to find two zero-days in software that handles protection relay data. Alongside the launch came a Daybreak Red group for critical infrastructure defenders and a $1 billion Frontline Defenders grant program.

The launch also carried a privacy fight. CyberScoop reports that from the end of the month, data from Daybreak Blue sessions on personal accounts would be used to improve models, reportedly regardless of opt-out, which angered users worried about training on their work. OpenAI safety lead Fouad Matin later said customers can keep opting out of training and that the data is for abuse prevention.

What the numbers do not say

The limits are substantial, and several are easy to lose in the headlines.

• Local only. These bugs need an existing foothold on the machine. They turn a low-privileged account or a compromised process into root; they are not remote break-ins.
• 7% of the kernel. The scan covered the code ordinary users can reach, not the whole tree. Nobody should read 948 as a census.
• No public verification. One review notes the post lists no CVE numbers and does not say how many patches maintainers accepted. OpenAI is withholding exploit code and the ten or more novel exploitation techniques it says the agents used.
• Patches are candidates. Machine-written and human-reviewed, but not upstream commits.

Disclosure is staged. Following kernel community guidance, OpenAI began with the critical findings, 304 of them sent to maintainers with candidate patches, and will route the rest through its Patch the Planet partners. By the end of the scan, other contributors had already patched 61 of the flaws upstream, staged fixes for 43, and had 299 more under public discussion. That is about 43% of the total, and it reads to us as evidence of bug collision: a large share of what these agents find is already being found by someone else. If so, the remaining bugs are unlikely to stay private for long either.

What to watch

The bottleneck has moved to review. Greg Kroah-Hartman told The Register in March that AI reports had moved past slop: “Now we have real reports.” That came with more review work, and kernel CVE volume was already nearing 2,000 per release before this batch. The number to track is how many of the 304 critical reports land as accepted commits, and how quickly.

There is also a structural worry. OpenAI researcher Eric Wallace says the company is putting “a significant share of its frontier compute” into finding and patching open-source flaws, while commentator Cody Fenwick welcomed the work but warned that defenders are relying on “random acts of kindness.” Open-source security now depends on a lab’s voluntary budget, and no one outside can size it.

For teams running Linux, the practical reading is simple. A shared kernel is a weaker boundary than it was. If you run untrusted code, including agent-generated code, in containers, assume a local privilege escalation is available at commodity prices. OpenAI’s own recommendation is defense in depth with isolation layers such as Firecracker and gVisor, though its campaigns also turned up flaws in Kata, Moby/Docker and gVisor, so those layers need patching too. OpenAI has promised more at a “Cyber at the Frontier” livestream on November 12.