OpenAI developed an autonomous pipeline for finding, validating, exploiting, and proposing patches for software vulnerabilities, centering on a cyber‑capable model. The prototype targeted the Linux kernel in a controlled research environment. In a mid‑October 2026 run the system dynamically reproduced 1,724 vulnerabilities and produced 948 working local privilege escalation (LPE) exploits for a commonly used Linux distribution; the end‑to‑end API cost was $1,213,430.
How the pipeline works
The prototype consists of five stages:
- Vulnerability discovery: Scout agents identify high‑value audit targets in the codebase.
- Dynamic validation: triage agents attempt to reproduce each candidate in isolated VMs and capture runtime evidence (for example, KASAN crashes).
- Exploitability assessment: ExploitDev agents test whether validated issues enable information disclosure or local privilege escalation.
- Patch generation: the model proposes fixes and performs variant checks.
- Human review: security researchers review exploits, patches, and severity before reporting upstream.
The pipeline bundles a root‑cause analysis, a minimal crashing proof‑of‑concept (PoC), a candidate patch, and a full exploit to help human researchers assess severity and upstream fixes.
Key metrics and costs
From the mid‑October 2026 run:
- Scout stage: identified 5,034 audit targets (~2.8 million lines of code, about 7% of the kernel); cost: $3,426.
- Analyst (static scanning): produced 2,308 candidate findings after deduplication; cost: $316,549.
- Dynamic validation: reproduced 1,724 vulnerabilities (~74.7% of candidates); cost: $73,330.
- Initial screening: reduced the set to 313 information‑leak candidates and 1,238 LPE candidates; cost: $44,194.
- Exploitation: produced 291 information‑leak PoCs and 1,169 working LPE exploits; the exploitation stage cost $775,929 ( $84,929 for info‑leak processing, $691,000 for LPE processing).
Total run cost: $1,213,430 in API credits — roughly $1,279 per produced LPE exploit. Successful exploits averaged $359 in credits to develop.
Comparisons with bug bounty programs and hardened targets
- Using historical Pwn2Own/TyphoonPWN bounties ($20,000 and $70,000) on the 948 exploits yields a hypothetical payout of $18.9M–$66.3M (about 16×–55× the pipeline cost).
- In a kernelCTF (hardened) environment the pipeline produced 25 information‑leak PoCs and 21 LPE exploits; that campaign cost ~ $32,936 in API credits. If those 21 vulnerabilities were accepted by the program, the prize value would be around $1.5M (~45× the scanning cost). For context, 26 confirmed 0‑day LPE exploits had been accepted by kernelCTF in 2026 at the time of writing.
Operational observations
- During the scan and the ten days after it finished, the Linux maintainers moved quickly: 61 LPEs were already patched upstream, 43 had staging patches, and ~299 were publicly reported or discussed.
- The main operational bottleneck was not discovery but prioritization and validation: which findings are reproducible, what security boundary they cross, and which need immediate maintainer attention.
- Of the candidates, ~3.1% were incorrect analyses (impossible conditions); others failed to reproduce due to required privileges, race conditions, or complex triggers.
- In a sampled set of 166 agent‑developed exploits, the team believes the agents used at least 10 previously unknown Linux exploitation techniques.
Model capability and orchestration tradeoffs
- A July 2026 run with GPT‑5.6 Sol found and exploited 166 unique LPEs for $513,690 in API credits. By mid‑October an improved cyber model found and exploited 948 unique LPEs for $1,213,430, despite three months of hardening between scans.
- The team found that stronger base models required less heavy orchestration. For GPT‑5.5 Cyber, providing a library of 103 techniques increased success rates for 63 exploitation candidates from 76.2% to 88.9%. With GPT‑5.6 Cyber, the model better discovered and applied techniques on its own, and heavy scaffolding provided only marginal further benefit.
Patch generation and quality
- Initially, directly prompting the model produced functionally correct patches but sometimes introduced unnecessary code, performance tradeoffs, style deviations, or missed variants. Iterative instructions and checks improved patch quality.
- OpenAI reports having already sent hundreds of reports and patches for critical vulnerabilities, following Linux kernel community guidance, and is working with Patch the Planet partners to submit more.
Safety, validation, and infrastructure findings
- The pipeline initially counted 200 successful LPEs in exploitation; human review discovered 20 cases where root was achieved via a different 0‑day than the assigned one. The team added independent checks to ensure each exploit used its assigned vulnerability.
- The agents also found a QEMU TCG vulnerability during the kernelCTF run; the issue had been fixed upstream in QEMU but existed in the release build used in the experiment. This highlights that frontier models can find vulnerabilities in testing infrastructure as well.
Strategic conclusions
- Automated patch generation will be increasingly necessary to match the speed of vulnerability discovery by frontier models and to reduce the exploitation window. With guided human iteration, AI‑generated patches can be correct, consistent with coding practices, and robust to variants.
- For the near‑to‑medium term, an unpatched low‑privilege account should be treated as nearly equivalent to root for a well‑resourced attacker; defense‑in‑depth (sandboxes, Firecracker, gVisor) is important.
- Large projects will likely need repeated scanning and fixing across model generations to reduce latent bugs; investing in models that write secure code by default, reducing attack surface, and formal verification are promising directions.
Closing
OpenAI’s Cyber team frames this research as methodology and capability measurement rather than a cost optimization exercise, and reports stage‑by‑stage API costs to help others reproduce or extend the work. Through initiatives such as Patch the Planet and Daybreak, the team aims to scale automated discovery and repair of critical open‑source software, so that successive model generations make software progressively harder to compromise.
