OpenAI Says Autonomous Agent Pipeline Built Linux Privilege Escalation Exploits for $1.2 Million

OpenAI has published the results of an experiment in which an unreleased cybersecurity model, driving an autonomous pipeline of agents, hunted for Linux kernel vulnerabilities and wrote exploits for them. According to the company, a single run in mid-October cost $1,213,430 in API credits. The figures come from OpenAI itself and were reported by outlets including SecurityWeek.

What the pipeline did

The target was the latest code from the Linux kernel's master branch. The agents first narrowed the kernel down to areas relevant to security and reachable by low-privileged users. They then flagged 2,308 potential bugs, of which 1,724 were confirmed.

The exploits were run on virtual machines with an unmodified desktop Linux configuration and protections such as KASLR, SMEP and SMAP turned on. OpenAI's security researchers reviewed the exploits, the fixes and the proposed severity ratings before anything was sent to kernel maintainers.

The figure of 948 that appears in headlines is described in different ways. According to OpenAI, as cited by SecurityWeek, it is the number of separate patches written for the bugs behind the exploits, while the number of working LPE exploits was 1,169.

New techniques and valuation

OpenAI says that, to the best of its knowledge, the agents discovered and used at least 10 novel Linux exploitation techniques, ones that kernel exploitation experts outside the company were not familiar with either. The company is withholding the technical details for safety reasons.

The company also converted the value of the findings using historical payouts from the Pwn2Own and TyphoonPWN contests, which paid $20,000 and $70,000 per Linux LPE exploit. That works out to between $18.9 million and $66.3 million, or 16 to 55 times the cost of the scan. This is OpenAI's own calculation, not an independent market valuation.

OpenAI points out that the October scan found more than five times as many new LPEs as the July one, despite three months of kernel hardening in between. In an adapted version of Google's kernelCTF, where the kernel is hardened and exposes less attack surface, the pipeline generated 21 LPE exploits in 112 hours for about $33,000.

Reports and patching

Following guidance from the kernel community, OpenAI has submitted hundreds of reports and patches for critical bugs. Fixes for the remaining flaws are to be sent in stages, together with partners in its Patch the Planet initiative. According to OpenAI, within the 10 days the scan was running, more than 100 Linux LPEs were patched or had staging patches from other contributors, and about 300 more were being discussed publicly.

What it means for admins

OpenAI warns that, in the near and medium term, a low-privileged account on a system without the latest patches should be treated as functionally equivalent to root access when the attacker is well resourced. The company recommends layered defenses, including isolation and sandboxing technologies such as Firecracker and gVisor.

For the near and medium term, having access to a low-privileged account on an operating system, that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor. - OpenAI, quoted by SecurityWeek

For Polish companies that run servers and containers on Linux, the practical takeaway concerns the pace of kernel updates and workload isolation. All the figures come from OpenAI, and the company is keeping the full technical details of the new exploitation techniques to itself for safety reasons.