OpenAI: autonomous cyber pipeline patches 948 Linux local privilege escalations
On 5 Nov 2026 SGT, OpenAI said its security researchers built an autonomous vulnerability discovery, exploitation, and patching pipeline; one run with an upcoming cyber model validated and generated patches for 948 Linux kernel local privilege escalations at about $1.21M in API cost (~$1,279 each).
Verified against OpenAI’s official posts on X and the follow-up (about 2026-11-04T23:13Z, ~07:13 on 5 Nov 2026 Asia/Singapore), with a matching note from Greg Brockman (@gdb):
OpenAI says its security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline. In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel.
On cost, OpenAI states the full run used $1,213,430 in API credits—about $1,279 per distinct local privilege escalation. Applying historical Pwn2Own and TyphoonPWN bounty rates, it cites a hypothetical value of $18.9M–$66.3M. OpenAI frames this as evidence that AI models can help secure software and that defenders should proactively analyze software to make attacks cost-prohibitive.
Greg Brockman separately wrote that the team had found, validated, and prepared patches for almost 1,000 Linux local privilege escalations at about $1,000 per vulnerability, calling it an emerging scalable approach to hardening open-source and proprietary projects.
OpenAI did not link a long-form blog post in these tweets, and did not say the cyber model is publicly available or give a launch date—it is described as an “upcoming cyber model.” Figures and framing follow OpenAI’s own wording.