OpenAI Agents at Linux. They Found 948 Ways to Take Over a Machine

The Hook

OpenAI says an autonomous AI pipeline found, reproduced, and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel, at a total API cost of about $1.2 million. Translation: an ordinary user account can be turned into a master key. Linux runs Android phones and most of the cloud, so yes, this is your business too.

The Meat

First, the numbers. Spotted on X: OpenAI's own security researchers say they built a pipeline that finds security-relevant code, scans for bugs, reproduces them in isolated environments, tests whether they can be exploited, and drafts candidate patches. In a single run with an upcoming cyber model, it reproduced 1,724 vulnerabilities. Of those, it produced proofs of concept for 291 information leaks and working exploits for 948 distinct local privilege escalation bugs. Those exploits worked on a stock Linux desktop configuration with standard security protections turned on.

The bill? $1,213,430 in API credits, or about $1,279 per distinct privilege escalation bug. For context, OpenAI applied historical Pwn2Own and TyphoonPWN bounty rates and landed on a hypothetical value of $18.9M to $66.3M. (Attackers can do that math too. Trust us.)

Now, the plot twist. According to OpenAI, the agents also discovered and used at least 10 exploitation techniques that, to the best of the company's knowledge and every expert it consulted, are brand new. The takeaway they want you to sit with: frontier models may not just apply known tricks, they may invent new ones.

As one Reddit write-up of the breakdown put it, the run happened in mid-October over about ten days. Agents scanned 2.8 million lines of security-relevant kernel code and turned 2,308 candidate findings into those 1,724 reproduced vulnerabilities (the reproduction stage fit inside 30 hours). Humans reviewed everything before anything went to maintainers, and OpenAI says it is working with Linux maintainers and Patch the Planet partners on reports and fixes. The stated goal: help defenders find and fix holes before attackers do, and make attacks cost-prohibitive.

The most interesting detail isn't the 948. That same Reddit post flagged what happened in an early run: the pipeline reported 200 successful exploits, but human review found that 20 of them got root through a different bug than the one assigned. OpenAI had to add an independent check that each exploit actually used its assigned vulnerability. If you run AI agents that grade their own homework, the lesson is simple: verify the path, not just the result.

Four Habits You Can Borrow

A viral thread on X by @MilanGlow dug through the write-up and pulled out four habits for anyone using tools like Claude Code or Codex:

• Prove it first. Every flagged bug had to be reproduced on a locked-down test machine. About 3 in 4 held up, and of the rest, only 3% were the AI being flat wrong.
• Check how it got there. See those 20 of 200 "successful" attacks above.
• Give it a quit rule. Failed attempts cost roughly 11x more than wins ($3,922 versus $360). OpenAI says stopping after an hour with no progress would have saved a lot.
• Retest when you upgrade. A library of 103 known attack techniques lifted an older model from 76% to 89%. On the newer model, it added only 1.5 points, so OpenAI deleted the scaffolding. Your harness has a shelf life.

The Fine Print

Before anyone panics (or celebrates), a few caveats. All the figures are OpenAI's own reporting. And according to that Reddit write-up, Linux maintainers had already patched 61 of these bugs through other channels while the scan was running. Also, the vulnerabilities are local privilege escalations, meaning an attacker needs a foothold on the machine first. That's exactly why the thread's final advice is so blunt: install your updates, because an out-of-date machine is in real trouble once a serious attacker gets any account on it.

Side Story: Inside OpenAI

Meanwhile, in a corner of X, one user relayed a Reuters report that OpenAI's head of product development, Tibo, has taken over an internal security-hardening effort, and that roughly a quarter of production engineers were moved onto security infrastructure in August. The post cites long-running issues like overly broad code repository access, internal tools without security review, and a recent meeting-room eavesdropping incident. It's unclear whether he has fully left his product role, and we haven't independently verified the report, so treat it as a "watch this space" item. The user's joke about the company shifting from a "Reset Company" to a "Token Company" tells you the mood.

The Takeaway

AI is now cheap enough, and good enough, to hunt for serious security bugs at industrial scale. That cuts both ways: defenders get a faster scanner, and attackers get a template. What to watch next is how quickly maintainers ship the fixes.

Your move today: update your phone, laptop, and any Linux boxes you manage. It's the cheapest security tool you own.