OpenAI says a team of its AI agents found 948 separate flaws in Linux that let an ordinary user take full control of a computer, and built a working attack for every one. The run cost $1.21 million, or $1,279 per flaw. Bug-hunting contests have paid $20,000 to $70,000 for a single flaw of this kind.
The figures come from a research post OpenAI published on Wednesday. They describe one run in mid-October using an unreleased “cyber model”, a version of its AI built for security work. The company says it has already sent hundreds of reports and fixes to the people who maintain Linux, starting with the most serious.
Linux is the free operating system underneath Android phones, most cloud servers and the world’s supercomputers. Its core, the kernel, runs to more than 40 million lines of code. A flaw there can reach billions of devices.
What the agents actually found
Every one of the 948 flaws is what security people call a local privilege escalation. In plain terms: someone who already has a basic account on a machine, or has tricked their way onto it, can use the flaw to become “root”, the all-powerful administrator who can read every file and change anything.
That is serious, but it is not the same as a remote break-in. An attacker still needs a foothold first, such as a stolen login or a malicious app. The flaws turn a small break-in into a total one.
OpenAI ran the attacks against a standard desktop version of Linux with its normal protections switched on, not a weakened test machine. It used the same rules as Pwn2Own and TyphoonPWN, two contests where hackers are paid for working attacks.
How the numbers break down
The work ran as a production line of AI agents, each with one job.
First, “scout” agents picked out the parts of the kernel an ordinary user can reach. They chose 5,034 targets, about 2.8 million lines, or roughly 7% of the code. That step cost $3,426.
Next, “analyst” agents read those targets and listed 2,308 possible flaws within 12 hours, for $316,549.
Then “triage” agents tried to prove each one by actually triggering it in a sealed-off virtual machine. Within 30 hours they confirmed 1,724, about three in four, as The Hacker News also reported. OpenAI says only 3.1% of the original list came from the AI misreading the code.
Finally, exploit agents tried to turn the confirmed flaws into real attacks. They produced 1,169 working takeover attacks and 291 attacks that leak private memory. After removing duplicates that shared the same root cause, OpenAI counted 948 distinct takeover flaws and wrote a fix for each. Human researchers reviewed the results before anything went to the Linux maintainers.
A successful attack cost an average of $359 in computing to build. The biggest single bill was the attack-building stage, at $775,929.
The economics are the story
OpenAI applied the contests’ past prize money to its haul. At $20,000 to $70,000 per flaw, the 948 would be worth $18.9 million to $66.3 million on paper, about 16 to 55 times what the run cost. OpenAI calls its cost an upper bound and expects better tooling to bring it down.
A second test points the same way. Against kernelCTF, a Google reward programme that uses a stripped-down, hardened version of Linux, the system produced 21 takeover attacks for about $32,936. OpenAI estimates those would be worth around $1.5 million in rewards if accepted, roughly 45 times the cost. For comparison, it says kernelCTF has accepted 26 such attacks from everyone combined so far in 2026.
The models are also getting better quickly. In late July, an earlier OpenAI model, GPT-5.6 Sol, found 166 unique flaws of this kind for $513,690. The October run found 948, more than five times as many, even though the kernel had three more months of fixes in between.
OpenAI also says the agents used at least 10 attack techniques that outside kernel experts had not seen before. It has withheld the details for safety reasons.
The people who have to fix it
The flaws do not fix themselves. Linux is maintained largely by volunteers and company engineers who review every change by hand, and they were already under strain before this report.
At the Kernel Recipes conference this autumn, Greg Kroah-Hartman, one of the kernel’s most senior maintainers, said the project is now fixing 33 security issues a day, LWN reported. The number fixed per release has roughly quadrupled from a long-run rate of about 500, a jump he put down to AI tools. His message was “don’t panic”: the kernel’s processes are coping. But he also said the best models are still wrong about half the time, and described a batch of 79 AI-found kernel bugs in which only 15 were confirmed as real, and all 15 had already been fixed.
In August he went further for one corner of the kernel. In a post to the kernel mailing list, he said he would reject AI-written patches for the drivers/staging area, with an exception for tested security fixes, because “at least 1/3 of the results they generate are flat out wrong or harmful.”
OpenAI’s own post shows why that caution makes sense. In an early run, its system reported 200 successful takeover attacks. Human review found that 20 of them had reached root through a different, unknown flaw from the one they were assigned. OpenAI added an independent check afterwards.
The maintainers are moving fast regardless. OpenAI says that by the time its 10-day scan and review finished, 61 of the takeover flaws had already been fixed in the main Linux code, 43 had fixes waiting, and 299 were being discussed in public. OpenAI says many of those fixes came from other contributors working on the same bugs.
What it means for you
For most people the advice is unglamorous: install updates. Android phones, home routers, smart TVs and cloud services all run on Linux, and the fixes only help once they reach your device.
OpenAI’s own conclusion is blunter. It says that for now, a low-level account on a system that is behind on updates “should be considered functionally equivalent to root access for a well-resourced threat actor.” In other words, if someone capable gets any foothold on an unpatched machine, assume they can take all of it.
It is the latest in a run of AI security results. Last month AI helped uncover the PHP2Shell flaw, and Anthropic said Claude had proved 123 open-source libraries could not crash. OpenAI itself this week raised its bug bounty to $172,000 for the worst flaws in its own products.
Why it matters
The cost of finding a serious Linux flaw has dropped to about $1,300 of computing, well below what contests have paid for one. The same capability that OpenAI pointed at defence will, as OpenAI itself expects, reach attackers too, so the real test is whether volunteer maintainers and device makers can ship fixes as fast as AI can find the bugs.
The post OpenAI’s Agents Found 948 Ways to Take Over Linux, at $1,279 Each appeared first on DailyAI.
