Finding serious software bugs is usually slow and costly, and human experts do it. In mid-October 2026, OpenAI tried another way. Its Cyber team ran an automated system on the Linux kernel, using a model it has not released. The kernel is the core of Linux, which runs Android phones, cloud servers and supercomputers. It has more than 40 million lines of code.
What the System Did
First, AI agents picked about 7% of the code to check, roughly 2.8 million lines. They chose the parts that an ordinary user can reach and that matter for security. Then other agents searched that code and listed 2,308 possible bugs in 12 hours. In the next 30 hours, test agents managed to trigger 1,724 of them on virtual machines.
In the end, the system built working attack code for 948 different local privilege-escalation bugs. These are flaws that let someone with a normal account take full “root” control of a computer. OpenAI counted 948 after grouping attacks that used the same flaw. The whole scan and checking took about 10 days.
The Cost and the Bounty Comparison
The computing cost, paid in API credits, was $1,213,430. That works out to $1,279 per bug. OpenAI compared this to contest prizes. Pwn2Own and TyphoonPWN have paid $20,000 and $70,000 for this kind of bug. By that math, 948 bugs would be worth $18.9 million to $66.3 million. OpenAI calls that a hypothetical value. The bugs were not actually sold, so it is a what-if.
A tougher test says more. On a hardened kernelCTF setup, the system took 112 hours and $32,936 to make 21 exploits. So far in 2026, that contest has accepted only 26 real ones from everyone. OpenAI says its 21 would have earned about $1.5 million, so even the hard test paid off.
What Is Not Verified
Nobody outside OpenAI can check these numbers yet. The model is not public, and OpenAI left out the technical details for safety reasons. Outsiders also cannot check how OpenAI grouped attacks that came from the same flaw. Some results are already confirmed, though. When the post came out, 61 of the bugs had been fixed upstream, and 43 more had patches waiting.
The AI also made mistakes. In an early run, it claimed 200 root exploits, but humans found that 20 of them used a different bug than the one assigned. OpenAI then added an independent check.
The Human Bottleneck
The biggest problem now is fixing bugs, not finding them. OpenAI says its researchers review every exploit and patch before sending it to Linux maintainers. But maintainers are people with limited time. If AI tools find hundreds of serious bugs, humans still have to test and apply every fix safely. Finding bugs got cheap. Fixing them is still slow.
