OpenAI pipeline finds 948 Linux kernel privilege-escalation flaws

On November 4, 2026, OpenAI published a report titled "A thousand fewer paths to root" describing an automated vulnerability-research pipeline. According to a post on DEV Community that relayed the report, the pipeline generated 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities, and produced 1,169 working local privilege escalation (LPE) exploits. After variant analysis, these were counted as 948 distinct LPE vulnerabilities, a result that a related source summarized as "AI agents found 948 Linux LPEs". The report was rated High severity, with the original source listed as OpenAI and a related source listed as SecurityWeek; the technologies involved included the Linux kernel, KASAN, kernelCTF, and an OpenAI cyber model.

It is worth noting that these results came from KASAN virtual-machine reproduction and exploitability testing in an isolated environment. They do not imply that upstream maintainers have accepted all of the patches, and no material indicates whether maintainers have responded. The story therefore currently stands at the point of OpenAI's own publication: the findings were made public on November 4, 2026, but no follow-up on patch review or remediation status has been reported.