AI found 948 Linux bugs for the price of 948 tiny crypto rugs 🐧

OpenAI said autonomous security agents identified 948 distinct Linux kernel vulnerabilities, created working local privilege-escalation exploits and drafted fixes for review during an October campaign costing $1,213,430 in API credits. The results were published Wednesday.

The agents scanned about 2.8 million lines of Linux kernel code, roughly 7% of the project, and initially identified and analyzed 2,308 candidate findings. They dynamically reproduced 1,724 vulnerabilities and produced 948 local privilege escalation (LPE) exploits that could allow an unprivileged local user to gain root access. The Linux kernel powers cloud servers, Android devices and much of the world’s critical computing infrastructure.

“We chose Linux to study how effectively frontier models could find vulnerabilities and demonstrate their security impact in a codebase of this scale and importance,” OpenAI said. The company grouped the exploits by underlying cause and proposed fix, resulting in 948 distinct flaws. Each vulnerability cost about $1,279 in API credits, compared with historical Linux privilege-escalation exploit payouts of $20,000-to-$70,000 at hacking competitions. OpenAI estimated a hypothetical manual value of $18.9 million to $66.3 million for the same findings.

OpenAI said the agents also used at least 10 exploitation techniques unfamiliar to the researchers and outside experts they consulted. An earlier GPT-5.6 Sol campaign found 166 unique privilege-escalation vulnerabilities in July for $513,690, while a newer, unreleased cyber model found more than five times as many in October despite months of kernel fixes.

The announcement followed Anthropic’s disclosure last week that an unreleased version of Claude had discovered and exploited serious vulnerabilities in widely used software, including Chrome and Linux, with some exploits capable of executing malicious code remotely with little or no user interaction. Researchers at Vidoc Security also reproduced several vulnerability discoveries associated with Anthropic’s Mythos AI using publicly accessible models for less than $30 per file. Anthropic unveiled Claude Mythos earlier this month, restricting the model to a vetted coalition of tech giants.