Openai System Finds and Fixes 948 Linux Escalation Flaws in 30 Hours
WHO:
The Hacker News - OpenAI used an upcoming cyber-focused AI model in its Linux security research pipeline.
The Hacker News - OpenAI said human security researchers review each exploit, patch, and proposed severity before reporting findings to maintainers.
The Hacker News - The article cites VulnCheck, Google Threat Intelligence Group (GTIG), and the U.K. National Cyber Security Centre (NCSC) on AI-assisted vulnerability discovery and cybersecurity risks.
TechRadar - OpenAI may be preparing to announce a new cyber model.
WHAT:
The Verge - OpenAI says GPT-6 Cyber went out of bounds less than 1% of the time during testing, compared with around 5% for GPT-5.6 Cyber.
The Verge - In the ExploitGym benchmark, GPT-6 Cyber scored 48.5%, versus 32.1% for GPT-5.6 Cyber and 42.4% for GPT-6 Astra; OpenAI says GPT-6 Cyber also helped find 81 previously unknown Firefox vulnerabilities.
The Verge - OpenAI says GPT-6 Cyber contributed to hardening its AI-model training infrastructure.
The Verge - GPT-6 Cyber is classified as Critical under OpenAI’s Preparedness Framework, while GPT-5.6 Cyber was classified as High.
The Hacker News - OpenAI said the pipeline’s API-credit cost was $1,213,430, also reported as $1.2 million.
The Hacker News - The pipeline generated 948 working local privilege escalation exploits for a commonly used Linux distribution.
The Hacker News - OpenAI said that, for a well-resourced threat actor, access to an operating system through a low-privileged account when it is not up to date on available patches should be considered functionally equivalent to root access.
The Hacker News - OpenAI said its prototype identified and analyzed 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities, and generated 948 local privilege escalation (LPE) exploits that could let an unprivileged local user gain root access.
The Hacker News - The pipeline also generated proofs of concept for 291 information-leak vulnerabilities.
The Hacker News - OpenAI reported discovering and using at least 10 novel Linux exploitation techniques.
The Hacker News - The run cost $1,213,430 in API credits, or $1,279 per LPE exploit; the articles round the total to $1.2 million.
The Hacker News - The research builds on 24 LPE exploits OpenAI said its GPT‑5.5‑Cyber model had discovered.
The Hacker News - GTIG figures show monthly vulnerability disclosures rising from 5,045 to 10,740, while high-risk disclosures rose from 131 to 350, a 167% increase.
The Hacker News - OpenAI said AI-generated patches can be functionally correct, match existing coding styles, and resist attack variants when developed through human expert-guided iteration.
Techmeme - OpenAI described the work as turning investigations that once required sustained, separate efforts into a systematic process.
WHERE:
The Hacker News - The vulnerabilities affected Linux kernel code and were tested for a commonly used Linux distribution.
WHEN:
The Hacker News - OpenAI said the pipeline reproduced the vulnerabilities and generated the exploits during a 30-hour run.
The Hacker News - OpenAI said the pipeline run occurred in mid-October 2026.
WHY:
The Hacker News - The U.K. National Cyber Security Centre said attackers have shown less caution about losing access because replacing it costs little, and that lower risk has broadened the activities for which cyber capabilities are used.
The Hacker News - OpenAI said automated patch generation should keep pace with frontier-model vulnerability discovery to secure software and limit the window for exploitation.
The Hacker News - The NCSC said organizations need to adapt internal patching and testing processes to the faster pace of vulnerability discovery.
HOW:
The Verge - GPT-6 Cyber is rolling out to select members of OpenAI’s Daybreak Red program, with availability planned for all Daybreak Red customers in the coming weeks.
The Verge - OpenAI says GPT-6 Cyber uses new checks to block high-risk activity, including attacks on power plants and water treatment facilities.
The Hacker News - The pipeline had five stages: vulnerability discovery, dynamic validation in a sandbox, exploitability assessment and proof-of-concept development, patch generation, and human review.
The Hacker News - The reported techniques included two persistent elastic objects for spraying objects in the target kernel cache, two page-grooming techniques to improve reliability, five data-only privilege-escalation techniques, and one arbitrary type-confusion technique.
The Hacker News - The NCSC said defensive AI tools can shorten the period between a zero-day and an N-day vulnerability, but systems may remain exposed without correct and widespread configuration.
(UPDATED November 6, 2026 04:02 UTC)
OpenAI’s cyber model found 81 Firefox flaws and generated hundreds of Linux exploits. Human researchers reviewed each exploit, patch, and severity before reporting findings. Select security customers are getting access, with broader availability planned in coming weeks.
--
(UPDATED November 5, 2026 20:08 UTC)
OpenAI’s cyber AI generated 948 exploits that could give Linux users root access. The pipeline reproduced over 1,700 vulnerabilities in 30 hours. Human experts review findings and patches, as defenders face pressure to update faster.
--
(UPDATED November 5, 2026 17:05 UTC)
OpenAI’s prototype found 948 Linux kernel privilege-escalation exploits during a 30-hour run. Human experts reviewed each exploit, patch, and severity before reporting findings to maintainers. The research highlights pressure to develop patches as AI accelerates vulnerability discovery.