OpenAI and the 948 Linux kernel flaws
OpenAI says it found 948 Linux kernel flaws that lead to root. What the figure means, what's still unfixed and what your organization should do about it.
OpenAI reports that one automated run produced exploits for 948 distinct Linux kernel flaws. They require prior access to the machine, and the figure comes from the company itself, with no independent verification. Public status as of November 6, 2026.
What OpenAI reported
On November 4 it published A thousand fewer paths to root. The run took place in mid-October on the kernel's master branch, and the exploits targeted a widely used desktop distribution, which it doesn't name, with its normal protections on.
| Item | Figure |
|---|---|
| Targets reviewed | 5,034 |
| Code reviewed | About 2.8 million lines, roughly 7% of the kernel |
| Candidate findings | 2,308 |
| Reproduced | 1,724 |
| Root exploits | 1,169 |
| Information-leak proofs | 291 |
| Distinct flaws | 948 |
| API cost | US$1,213,430 |
| Cost per flaw | US$1,279 |
| July run, with GPT-5.6 Sol | 166 flaws for US$513,690 |
OpenAI counts the 948 as unique flaws based on 948 distinct patches. It chose the reviewed code because low-privileged users can reach it, so it isn't a random sample: it doesn't let anyone estimate how many flaws sit in the other 93%.
The model is GPT-6 Cyber, which OpenAI announced on November 5, with access through its Daybreak Red program. The company classifies it as Critical for cybersecurity under its Preparedness Framework.
What it means and what it doesn't
- They're local escalations. Each exploit takes an unprivileged user to root. They can't be used to break into a server from the internet: they need a first foothold, such as a vulnerable web application. That's the chain we covered in part 2 of this series.
- Finding isn't fixing. OpenAI says it has sent maintainers 304 critical findings with candidate patches, and that the rest are in progress. At the end of the 10 days of scanning and analysis, other contributors had already fixed 61 escalations, had 43 in staging and were discussing 299. We don't know how many of OpenAI's patches have reached a released kernel.
- There was human review, and it was needed. In an early run, 20 of 200 exploits got root through a different flaw from the one assigned, which was caught in review.
- There's no public detail to check. The distribution remains unnamed, and OpenAI withholds for safety the details of at least 10 new exploitation techniques, found in a sample of 166 exploits.
- It isn't this week's SSH flaw. OpenAI didn't find sshole, which is a separate story calling for a different response: we cover it in sshole: the OpenSSH flaw on Alpine and what to do.
OpenAI's conclusion is the practical part: in the near and medium term, an unprivileged account on a system without current patches should be treated as nearly equivalent to root against a well-resourced attacker.
Is there a crisis?
We found no primary source describing a global crisis, and we found no reports of attacks using these flaws. What is documented is the pressure on the people doing the fixing, along with signs that they're responding:
- The kernel documentation now asks that flaws found with AI be treated as public, since they tend to surface with several researchers at once, and warns that these reports overload maintainers.
- Risky Bulletin counted 442 kernel CVEs in three days in July, mostly low severity and likely found with AI. It also noted Linus Torvalds's complaint about duplicate reports.
- OpenAI, for its part, praises the speed of the kernel's maintainers.
- It isn't only Linux. The GPT-6 Cyber announcement reports 81 new high-severity Firefox flaws, classified by Mozilla, and argues that there's limited time to secure software.
The underlying shift is in speed and cost: from July to October, the cost per flaw OpenAI reports fell from about US$3,100 to US$1,279. The hard part becomes getting the fixes onto machines.
What to do
- Keep the kernel current and reboot. A new kernel doesn't protect anything until the machine boots from it.
- Treat unprivileged accounts as a real risk, especially on shared servers or those with exposed applications.
- Fix what provides the first foothold. Without it, these flaws are useless: web applications, credentials and exposed services.
- Isolate untrusted code. OpenAI recommends layers such as gVisor or Firecracker.
- Ask your provider how often they apply kernel patches and whether they reboot afterwards.
What we don't know
- Which flaws make up the 948, and how many are fixed in the versions distributions use.
- Whether anyone else has already found or is using them.
- Whether a third party can reproduce these figures.
Frequently asked questions
Do the 948 flaws allow entry from the internet? Not on their own. They're privilege escalations: the attacker must already be running something on the machine.
Are they verified? They're OpenAI's figures. We found no independent verification.
Is there something specific to install? There's no single update. What helps is keeping the kernel current and limiting who can run code on your machines.
Is it related to sshole? No. That OpenSSH flaw was reported by another researcher and can be exploited over the network on certain systems.
Sources
- OpenAI, "A thousand fewer paths to root" (November 4, 2026).
- OpenAI, GPT-6 Cyber announcement (November 5, 2026).
- Linux kernel documentation, security reports.
- Risky Bulletin, Catalin Cimpanu, on the 442 CVEs (July 22, 2026).
Follow the series
- sshole: the OpenSSH flaw on Alpine and what to do
- Part 1: Server security in the AI era
- Part 2: the kernel flaw that turned PHP2Shell into full control
Contact
If you need to review how your organization's servers are maintained and updated, ITLab can help. Contact us.
Do you need someone to take care of your technology?
Tell us what you need to organize, protect or solve. The first conversation has no cost: we assess whether our model fits you and what the next steps would be.
Let's talk about your business