OpenAI's security team published a research note on 4 November describing a five-stage pipeline that treats vulnerability research as a production process rather than a series of one-off investigations. It ran against the Linux kernel's master branch in mid-October 2026, and the numbers are the story.
Scout agents read the tree and picked 5,034 audit targets — about 2.8 million lines, roughly 7% of the kernel — for $3,426 in API credits. Analyst agents worked through those targets and returned 2,308 deduplicated candidate findings within 12 hours, at $316,549. Triage agents then built a proof of concept for every candidate in an isolated virtual machine running a KASAN kernel, refining each one until the crash reproduced. Result: 1,724 confirmed vulnerabilities in 30 hours, 74.7% of the candidates, for $73,330. Only 3.1% of the failures were cases where the model's analysis was simply wrong; the rest needed privileges or depended on race conditions and allocation-failure triggers that did not fit the time budget.
Exploit-development agents, working against real protections — SMEP, SMAP, KASLR, HARDENED_USERCOPY — produced 291 information-leak proofs of concept and 1,169 working local privilege escalations that gave an unprivileged user root. Variant analysis collapsed those into 948 distinct patches, which OpenAI uses as its proxy for unique LPEs. End-to-end bill: $1,213,430 in API credits.
The comparison that matters is economic rather than technical. Pwn2Own has historically paid $20,000 for a Linux kernel LPE and TyphoonPWN $70,000; applied to 948 exploits, that is a hypothetical $18.9M–$66.3M, or 16x to 55x what the pipeline cost. A second campaign against kernelCTF's hardened kernel — 112 hours, $32,936 — produced 25 information-leak PoCs and 21 LPEs. For scale, 26 confirmed zero-day LPEs have been accepted by kernelCTF during all of 2026; had the 21 been accepted, the payout would have been roughly $1.5M, about 45x the cost. OpenAI concludes from this that its pipeline was, on public payout figures, net profitable.
Capability is moving faster than the harness
In late July 2026 the same experimental setup, run with GPT-5.5 Cyber and then GPT-5.6 Sol, found 166 unique LPEs for $513,690. The October run used what OpenAI calls an upcoming cyber model and found 948 against the same target. That leads to an uncomfortable operational takeaway: old audit results have a shelf life, and previously reviewed code should be rescanned as models improve, even with an unchanged harness.
The orchestration finding points the same way. Handing GPT-5.5 Cyber a library of 103 Linux exploitation techniques in a model-friendly format lifted its success rate from 76.2% to 88.9% across 63 candidates. Handing the same scaffolding to the newer model bought 1.5 percentage points, so OpenAI deleted it. Heavier orchestration appears to be a crutch that better models no longer need — and one that costs money to maintain.
The agents found things their handlers did not expect
Sampling 166 of the developed exploits, the researchers identified 10 exploitation techniques they believe are new: two persistent elastic objects for spraying the target kernel cache, two page-grooming methods for reliability, five data-only routes to privilege escalation and one arbitrary type confusion. Third-party kernel exploitation specialists to whom OpenAI showed them had not seen them either. The technical details are deliberately withheld.
Equally instructive are the mistakes. In an early run, the exploitation stage reported 200 successful local privilege escalations. On human review, 20 of them had reached root through a different zero-day than the one the agent had been assigned. OpenAI tightened the task constraints and added an independent check that each final exploit used its assigned bug. Verifying the result, in other words, is not the same as verifying the path to it.
The pipeline also found a QEMU TCG vulnerability while agents were probing system-call entry code — without access to QEMU's source. It had already been fixed upstream, but not in the release build the experiment used.
What the maintainers got
OpenAI says it followed the kernel community's guidance, started with critical issues, and is working through Patch the Planet partners for the rest. Ten days after the mid-October scan, 61 of the LPEs had been patched upstream, 43 had staging patches and 299 were being reported or discussed publicly. That is a striking volume of kernel work landing in a single cycle, and it is also the part of the story with the least public visibility: the numbers come from OpenAI, the technique details are withheld, and whether this rate of machine-generated patching is sustainable for volunteer maintainers is an open question rather than a measured one.
The dual-use question sits underneath all of it. The same pipeline that generated patches also generated 1,169 working root exploits against an unpatched kernel, and OpenAI's stated goal — to make exploitation cost-prohibitive for attackers — depends on defenders running this kind of analysis before someone else does.
