OpenAI says its AI found 948 Linux flaws and wrote an exploit for every one

OpenAI says its AI found 948 security holes in the Linux kernel. It also says the AI built a working attack for every single one of them.

The disclosure, made on November 4, 2026, lands squarely in crypto’s backyard. Security voices in the industry argue that decentralization makes crypto more resilient than traditional software.

What OpenAI’s pipeline actually found

According to OpenAI, the flaws are local privilege escalation vulnerabilities, known in security circles as LPEs. An LPE lets someone with limited access on a machine gain root control. Root is the top level of permission. Whoever holds it can do essentially anything on that system.

OpenAI ran the analysis in mid-October 2026 using what it describes as an autonomous vulnerability discovery pipeline built on a proprietary model. The system started with 2,308 candidate bugs. It validated 1,724 of them as real vulnerabilities.

From that pool, it produced 948 unique working LPE exploits. It also generated 291 proofs-of-concept for information leak vulnerabilities, which are flaws that expose data rather than hand over control.

The exploits reportedly succeeded on hardened stock builds. Hardened builds are configurations designed to resist exactly this kind of attack, so that detail matters.

The price tag is the other headline. OpenAI put the total operational cost at $1,213,430. That works out to approximately $1,279 per unique exploit.

How the model got so fast

Part of the efficiency comes from triage. The Linux kernel contains over 40 million lines of code. OpenAI says its system narrowed that down to roughly 2.8 million lines it considered security-relevant.

The pipeline does more than flag problems. Its outputs include root-cause analysis, minimal crashing proofs-of-concept, candidate patches and full exploits. Those are handed to humans for review and reporting to upstream Linux maintainers.

Within 10 days of the run, 61 vulnerabilities received upstream patches. Additional fixes are in staging or public review.

A steep climb in a few months

The October figures did not come out of nowhere. Earlier versions of the same effort produced far smaller results.

In June 2026, a model called GPT-5.5 Cyber yielded 24 LPEs. In July 2026, GPT-5.6 Sol found 166, at a cost of $513,690.

Then came October’s 948. Between July and October, the exploit count rose more than fivefold while the total bill only a bit more than doubled.

What it means for crypto

Crypto security voices argue that decentralization gives the industry an edge over traditional software. The logic is straightforward: a network spread across many independent operators has no single server whose compromise brings everything down.

But decentralization protects the network, not necessarily the individual. Any crypto operator whose machines run a vulnerable Linux kernel would face the same root-access risk as anyone else. That would include anyone running a node, a validator or a custody setup on such a system.

Root access on a machine holding signing keys is not a theoretical inconvenience. The protocol layer can be robust while the operational layer remains as exposed as any other Linux deployment.

The stakes from here

For defenders, the news is mostly encouraging. OpenAI is routing its findings through human review and upstream disclosure, and patches are already landing.

If a well-resourced lab can generate working kernel exploits for about $1,279 each, the barrier to mass exploit generation is falling.

For crypto infrastructure operators, the practical takeaway is less about philosophy and more about maintenance. The 61 patches already upstream, and the fixes still in review, only help systems that actually install them.