ResearchOpenAI

OpenAI system finds and patches 948 Linux security flaws

Original title: A thousand fewer paths to root

Plain language

What it is: OpenAI developed an automated system that can find, test, and fix security flaws in software. In a test run, the system successfully found and created patches for 948 security vulnerabilities in the Linux operating system.
How it works: The system uses AI agents to scan the software code, test the flaws in a safe isolated environment to prove they are real, and then write fixes for them. Finally, human security experts review the findings and the suggested fixes.
Where it is available: This system is currently a research prototype and was tested on the Linux kernel in a controlled environment. It is powered by an upcoming cyber model from OpenAI.
Example: The system scanned the Linux kernel code, found flaws that could let an unauthorized user gain full control of a system, and automatically wrote patches to fix those flaws.

What it is: OpenAI built an autonomous vulnerability discovery, validation, and patching pipeline powered by an upcoming cyber model. The pipeline successfully identified, reproduced, and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel.
How it works: Scout agents first identify security-relevant targets, and Analyst agents scan them for vulnerabilities. Triage agents then dynamically reproduce these findings in isolated virtual machines using Kernel Address Sanitizer to generate proofs of concept, followed by automated patch generation and human review.
Where it is available: The pipeline is a research prototype tested inside a controlled environment on the Linux kernel, including a stock desktop operating system and an adapted kernelCTF environment.
Example: In a mid-October 2026 run, the pipeline dynamically reproduced 1,724 vulnerabilities and generated 948 working local privilege escalation exploits along with candidate patches.

The headline and explanation on this page are based on OpenAI's post. The full details are in the original.

A thousand fewer paths to root