OpenAI published an account on 4 November of an autonomous pipeline that scanned the Linux kernel, found vulnerabilities, wrote exploits for them and generated patches. The number that travelled was 948 local privilege escalation exploits for 1,213,430 dollars in API credits.

The number that matters is in the same post, further down, and nobody has quoted it.

What the run actually was

The pipeline has five stages and ran in mid-October 2026 on a model OpenAI describes only as upcoming. Scout agents picked 5,034 audit targets, about 2.8 million lines, roughly 7 percent of the kernel. Analyst agents produced 2,308 candidate findings in 12 hours. Triage agents reproduced 1,724 of them within 30 hours, which is 74.7 percent, each confirmed by a proof of concept run against a kernel built with address sanitiser rather than by static judgement.

Exploit development agents then worked against a stock desktop configuration with SMEP, SMAP, KASLR and hardened usercopy all enabled. They produced 291 information leak proofs of concept and 1,169 working escalations. Variant analysis collapsed those into 948 distinct vulnerabilities with 948 patches, and it is that figure OpenAI uses as its count of unique bugs.

So 948 is a count of vulnerabilities, not of exploits. There were 1,169 exploits.

Where the money went

OpenAI publishes a cost for each stage, which is unusual, and it is the most useful thing in the post. Scout agents 3,426 dollars. Analyst agents 316,549. Validation 73,330. Screening 44,194. Exploitation 775,929.

Those add to 1,213,428, two dollars short of the stated total, and patch generation, a full stage of the pipeline, is never given a price at all.

The shape of the bill is the opposite of the public anxiety. Finding the bugs, Scout and Analyst together, cost 319,975 dollars, which is 26 percent. Writing the exploits for them cost 64 percent. Discovery is the cheap end of this.

The failures cost more than the successes

OpenAI gives two averages in one sentence: a successful exploit cost about 360 dollars to develop, and each of the 69 unsuccessful attempts cost about 3,922.

Multiply them out. The 1,169 successes come to roughly 420,840 dollars. The 69 failures come to roughly 270,618, which is 39 percent of the entire escalation budget, and they produced nothing. OpenAI says a give-up condition, such as stopping after an hour without progress, would have cut that significantly. That is both an honest admission and a plain instruction to anyone copying the method.

The number that actually matters

In late July 2026 an earlier model, GPT-5.6 Sol, found and exploited 166 unique escalations end to end for 513,690 dollars. That is 3,094 dollars each.

In mid-October the newer model found and exploited 948 for 1,213,430. That is 1,280 dollars each.

The cost per exploit fell by 59 percent in eleven weeks, against the same target, with three months of upstream hardening in between. OpenAI's framing is that stronger models find more, and it reports more than five times as many novel escalations. The price movement is the sharper statement and the one that should drive planning.

The part that will not be quoted

During an early run the exploitation stage reported 200 successful escalations. Human review found that 20 of them, one in ten, had reached root through a different zero day than the one assigned. OpenAI tightened the task constraints and added an independent check that each final exploit used the vulnerability it was given.

The pipeline also found and exploited a QEMU flaw in OpenAI's own test infrastructure, traced by an agent that had no access to QEMU source.

And the comparison everyone will reach for needs care. We wrote yesterday about Claroty Team82 reproducing three already-public CVEs with an agent for about six dollars and 28 minutes. This run cost 1,280 dollars a bug. The gap is not model quality. Reproducing a disclosed CVE with its classification in hand is a different job from finding an unknown flaw in 40 million lines and exploiting it past modern mitigations. Both numbers are real and neither means much without the other.

What to take from it

  • Price your exposure window on discovery cost, not exploitation cost. Discovery is 26 percent of this bill and it is the part falling fastest.
  • Treat an unpatched local account on a current kernel as close to root for a well-resourced attacker. That is OpenAI's own recommendation and it follows from the numbers.
  • Automated patching is the load-bearing half. Within ten days of the scan, 61 of the escalations found had upstream fixes and 43 had staging patches, from other contributors working in parallel.
  • Rescan code you have already audited when a stronger model ships. The same harness against the same target found more than five times as much three months later.

What is not established

  • Which model this was. OpenAI calls it upcoming and gives no name or date.
  • How many of the 948 affect a shipping distribution kernel rather than the master branch.
  • How many patches maintainers have accepted. OpenAI says hundreds of reports and patches have gone out for critical issues, with the rest following gradually.
  • Whether the 10 exploitation techniques are genuinely new. OpenAI says to the best of its knowledge, had them reviewed by outside kernel experts, and withholds the technical detail.
  • Whether the costs generalise. OpenAI says harness engineering could reduce them and treats its figures as an upper bound.