OpenAI pointed an AI at the Linux kernel last month and asked it to break in. The AI came back with 948 working ways for an ordinary user account to seize full control of a machine, each one with a working exploit and a proposed fix, and the whole run cost about $1.2 million in computing. OpenAI described the experiment on November 4 in a research post called "A thousand fewer paths to root", and on November 5 it released the model behind it, GPT-6 Cyber, to a small group of vetted security customers. The numbers are the kind that make security teams sit up straight, because they suggest the cost of finding serious software flaws has just collapsed, and the people doing the finding no longer have to be human.
How the machine did the hacking
The pipeline OpenAI built runs in five stages, and humans only show up at the end. Scout agents picked 5,034 places in the kernel worth auditing, covering about 2.8 million lines of code, or roughly 7 percent of a codebase that runs past 40 million lines. Analyst agents turned those targets into 2,308 candidate flaws in about 12 hours, then triage agents reproduced 1,724 of them inside isolated virtual machines. Exploit agents then attacked the survivors with the usual protections switched on, the same defenses a normal Linux desktop runs, and produced 1,169 working root exploits plus 291 demonstrations that leak memory. After grouping variants together, OpenAI counted 948 distinct bugs, each with its own patch, for a total bill of $1,213,430 in API credits, about $1,279 per exploit.
That is a steep jump from where this stood a few months ago. In July, the same test setup running GPT-5.6 Sol found and exploited 166 bugs for about $514,000, and back in June, GPT-5.5 Cyber managed 24. The October run found more than five times as many flaws as July, even though the kernel had three more months of hardening in between. OpenAI also says that in a sample of 166 exploits, its agents used 10 attack techniques that outside kernel experts had not seen before, including new ways to spray kernel memory. The company is keeping the details of those techniques to itself, and it says human researchers review every exploit, patch and severity rating before anything goes to the maintainers.
What $1.2 million buys in the bug market
OpenAI did some bounty math that is worth reading with a skeptical eye. Past hacking contests have paid $20,000 to $70,000 for a working local privilege escalation exploit, and at those rates the 948 exploits would be worth somewhere between $18.9 million and $66.3 million, or 16 to 55 times what the run cost. That is OpenAI's own arithmetic and not a real payout, since not every finding would qualify for a bounty, but it shows the shape of the problem. If finding a serious bug costs a thousand dollars instead of tens of thousands, a lot more people can afford to look, and not all of them will be on the defensive side. The same model also found 81 previously unknown high-severity vulnerabilities in Firefox, and Mozilla has started shipping fixes. Of the 948 Linux bugs, 588 were previously unknown, according to CSO Online.
The disclosure side of this is moving more slowly than the discovery side, and OpenAI seems to know it. Ten days after the scan, 61 of the bugs had been patched upstream, 43 had patches waiting in staging, and 299 were being talked about in public. OpenAI says it has already sent hundreds of reports and candidate patches for the critical flaws to kernel maintainers, and the rest are going out in stages with partners in its Patch the Planet effort. That is the responsible way to handle it, but it also underlines the bottleneck. The kernel is maintained largely by volunteers, and a machine that can find 948 bugs in a few days will always outrun the humans who have to read, test and approve the fixes. The scan only touched 7 percent of the kernel, so there is plenty of code left to look at.
A powerful tool, kept on a short leash
GPT-6 Cyber is not something you can just sign up for. OpenAI rates it "Critical" for cybersecurity under its own preparedness framework, its highest designation, and it is initially available through the API and Codex only to a select group of approved Daybreak Red customers, with identity checks, security requirements and IP allowlisting. In its own honeypot test, the model went beyond its intended scope in only 0.07 percent of cases, against 5.51 percent for its predecessor. On ExploitGym, a benchmark that tests whether a model can exploit a given vulnerability in a remote system, GPT-6 Cyber scored 48.5 percent, against 32.1 percent for GPT-5.6 Cyber. The Decoder notes that all of these benchmark figures come from OpenAI itself, and no independent testing has been published yet, so take the exact scores with a grain of salt.
The uncomfortable part is not what GPT-6 Cyber did, it is what its existence implies. OpenAI's own conclusion is blunt: a low-privileged account on a system that is behind on patches should now be treated as functionally equivalent to root access for a well-resourced attacker. Patching was always important, but the window between a flaw existing and someone finding it has shrunk from months to days, and the finder may be a machine that never sleeps. For defenders, the same tool is a gift, since it finds bugs and writes patches at a speed no team can match. For everyone else, the message is simpler: keep your systems updated, because the machines that find the holes are getting faster, cheaper and better, and they are not going to wait for you to catch up.
---------------
Author: Alan Ward
Seattle News Desk