OpenAI published research on November 4, 'A thousand fewer paths to root,' describing a mid-October run in which an autonomous pipeline built on an upcoming cyber model hunted flaws in the Linux kernel. Scout agents picked 5,034 places to audit — about 2.8 million lines, roughly 7% of the kernel — and the pipeline turned 2,308 candidate findings into 1,724 dynamically reproduced vulnerabilities.

After variant analysis grouped exploits tracing back to the same flaw, OpenAI counts 948 distinct local privilege-escalation vulnerabilities, each backed by a working exploit — counted only when it produced a root shell on a stock desktop system with standard protections on — and a candidate patch. The whole run cost $1,213,430 in API credits, with exploitation the most expensive stage at $775,929; OpenAI values the haul at $18.9 million to $66.3 million at past bug-bounty contest rates, and puts the model's outright incorrect analysis at 3.1%.

The bounds matter: 948 is a count of distinct flaws with candidate patches, not fixes already on anyone's machine, and the post names no CVE identifiers, kernel versions or subsystems. Ten days after the scan, OpenAI says 61 flaws had already been patched upstream, 43 had patches in staging and 299 were being reported and discussed. The work sits under Patch the Planet, part of OpenAI's Daybreak programme, with human review before anything reaches a maintainer.