OpenAI published a report on November 4, titled A thousand fewer paths to root, describing what happens when an autonomous agent pipeline is pointed at the Linux kernel and left to work. In a ten-day run in mid-October, a pipeline powered by an upcoming OpenAI cyber model produced working exploits for 948 distinct local privilege escalation vulnerabilities, each one a path from an ordinary, low-privileged user account to root on a stock desktop Linux distribution. The run cost 1,213,430 dollars in API credits, which works out to about 1,279 dollars per unique exploit. OpenAI also drafted a patch for every one of the 948 bugs.
The pipeline had five stages: discovery, dynamic validation, exploitability assessment, patch generation, and human review. Scout agents selected 5,034 audit targets, about 2.8 million lines of code, or roughly 7 percent of the kernel. Analyst agents turned those targets into 2,308 deduplicated candidate findings within 12 hours. A triage agent then built a proof of concept for each candidate and ran it in an isolated virtual machine with Kernel Address Sanitizer enabled, reproducing 1,724 of them, or 74.7 percent, within 30 hours. Exploit-development agents worked against the protections a normal distribution ships, including SMEP, SMAP, KASLR, and HARDENED_USERCOPY, and returned 1,169 working privilege-escalation exploits. Variant analysis folded those into the final 948 distinct root causes. In a sample of 166 exploits, OpenAI's analysts counted at least ten exploitation techniques they believe are new.
The trajectory matters more than the headline number. In late July, a run driven by GPT-5.6 Sol found 166 unique privilege-escalation bugs. Earlier work under OpenAI's Patch the Planet initiative, using GPT-5.5 Cyber, produced 24. The new run found more than five times the July total despite three months of intervening kernel hardening. OpenAI reports that after ten days, 61 of the flaws had already been patched upstream, 43 had patches in staging, and 299 were under public discussion. Priced at the 20,000 to 70,000 dollars that exploit contests have historically paid for a single Linux kernel privilege escalation, the haul would notionally be worth 18.9 million to 66.3 million dollars, against a compute bill of about 1.2 million.
For anyone who builds or operates systems, the practical lesson is uncomfortable. OpenAI's own guidance is to treat any unpatched multi-user Linux system with low-privileged accounts as effectively root-exposed to a well-resourced actor. That reframes patch cadence from routine maintenance into a front-line control, and it raises the value of sandboxing, least-privilege service accounts, and fast kernel update channels. The defensive reading is real, too: the same pipeline that builds exploits also drafts patches, and human review remained a stage rather than an afterthought. Discovery, reproduction, and first-draft remediation are becoming industrial processes, and security teams that still triage by hand will be outpaced by both sides.
The contrast with consumer agents is striking. On its third-quarter earnings call on November 4, Uber told analysts that during its busiest week in October, the week of Halloween, exactly four rides were ordered through an AI agent, and about 500 Uber Eats orders, out of roughly 320 million trips and orders in total. DoorDash reported a similarly tiny number the week before. Agents that book rides are, so far, a rounding error. Agents that hunt kernel bugs just produced 948 root exploits in ten days. The capability is arriving first where the work is verifiable, machine-checkable, and economically concentrated, and that is where builders should expect it to bite first as well.
