OpenAI has revealed that an unreleased AI model identified 948 unique security vulnerabilities in Linux and developed exploits that could allow users to gain root access. The cybersecurity research campaign, conducted in October, cost the company $1,213,430 in API credits.
The company shared the findings on X, stating that its researchers had developed an automated system for discovering, exploiting and patching vulnerabilities.
The aim was to help security teams identify and fix flaws before attackers could exploit them. OpenAI has not disclosed the model’s name or release date.
According to the company, the AI system scanned around 2.8 million lines of Linux kernel code, identified 5,034 security-relevant targets and generated 2,308 potential findings within 12 hours.
It confirmed 1,724 vulnerabilities within 30 hours and developed 1,169 working local privilege escalation exploits, corresponding to 948 unique vulnerabilities.
OpenAI also reported discovering at least 10 previously unknown exploitation techniques. Human researchers reviewed the findings before reports and proposed fixes were sent to Linux maintainers.
The company estimated that the vulnerabilities could represent $18.9 million to $66.3 million in hypothetical bug bounty value, compared with the campaign’s cost.
In an earlier July campaign, GPT-5.6 Sol identified 166 unique Linux vulnerabilities at a cost of $513,690.
OpenAI is also working with Linux maintainers through its Patch the Planet initiative to address security flaws.
