
OpenAI just pointed an autonomous agent pipeline at the Linux kernel. It came back with 948 working local privilege-escalation exploits. In one run the agents: → Identified 2,308 potential security flaws → Successfully reproduced 1,724 of them → Developed working exploits for 948 distinct vulns that let limited access escalate to full root → Generated candidate patches for human review Total cost: ~$1.21 million in API credits (~$1,279 per distinct exploited vulnerability). For scale: their earlier July system (powered by GPT-5.6 Sol) found and exploited 166. This one did 948. Linux maintainers had already patched 61 upstream by the time the research wrapped; more were in preparation or under discussion. This is the shift from “AI helps write code” to “AI agents systematically hunt, reproduce, and propose fixes for security holes in the world’s most critical software at industrial scale.” Finding flaws is getting cheaper and faster. Triaging and fixing them at that volume is now the bottleneck. Controlled research environment. Existing foothold required. Expert review still needed before any patches ship. But the volume signal is unmistakable.


