The Information Machine
FollowingDay 4in the edition since 5 Nov 20266 sourcesupdated 6 Nov 2026

OpenAI's autonomous kernel vulnerability pipeline

The gist

Latest: GPT-6 Cyber Built 948 Linux Kernel Exploits, Found 81 Firefox Bugs

An AI pipeline can now confirm and weaponize Linux kernel privilege-escalation bugs at roughly $1,279 per vulnerability, sharply lowering the cost of exploitation. OpenAI warned that a low-privileged account on an unpatched system should be considered functionally equivalent to root access for a well-resourced threat actor.

When stories like this move, I write about them in an email each morning.

One free email each morning, around 8 AM US Eastern.

The full picture

OpenAI's GPT-6 Cyber model, accessed via its Daybreak Red program, powered an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel. Scout agents narrowed the kernel's 40 million-plus lines of code to roughly 2.8 million lines for auditing; the system flagged 2,308 suspected bugs, confirmed 1,724 on test machines, and built working exploits for 948. GPT-6 Cyber vastly outperformed its predecessor GPT-5.6 Sol, which found 166 bugs under the same conditions. The model also found 81 previously unknown Firefox vulnerabilities, with Mozilla releasing fixes for many. Total API cost for the kernel run was $1,213,430, with $775,929 attributed to exploit generation; because OpenAI used its own model, that figure may not reflect cash outlay. OpenAI tested the system against a hardened version of Google's kernelCTF, producing 21 LPE exploits over 112 hours at roughly $33,000 in API credits. Human reviewers checked results before patches were submitted to Linux kernel maintainers, and OpenAI is submitting fixes in stages through its 'Patch the Planet' initiative.

How it developed
5 November 2026

OpenAI announced on November 4, 2026 that an autonomous pipeline found and patched 948 local privilege-escalation bugs in the Linux kernel in a single run, using an unreleased cyber-focused model.

Scout agents first narrowed 40 million-plus kernel lines to 2.8 million; the system then ran 2,308 flagged bugs to 1,724 confirmed on test machines to 948 with working exploits and patches. The API cost was $1,213,430, about $1,279 per vulnerability; human reviewers checked results before submission to kernel maintainers.

in the 6 Nov edition

OpenAI confirmed GPT-6 Cyber as the model behind the pipeline that found 948 Linux kernel privilege-escalation bugs and also found 81 previously unknown Firefox flaws, with Mozilla releasing fixes for many.

SecurityWeek reported the pipeline produced 21 LPE exploits against Google's kernelCTF over 112 hours at roughly $33,000. Within 10 days, over 100 of the kernel vulnerabilities had been patched or staged, with OpenAI submitting fixes through its 'Patch the Planet' initiative.

First in the edition · 5 November 2026
25 October 2026

Reporting noted AI-generated patches and bug reports straining Linux kernel maintainer bandwidth, with new disclosure requirements and a spike in CVEs

Sources
1 more source

Get the daily email

When stories like this move, I write about them in an email each morning.

One free email each morning, around 8 AM US Eastern.

See the latest edition · Privacy