AI just found 948 ways to break Linux

In November 2026, OpenAI published research where a team of AI agents went looking for security bugs in the Linux kernel, the core of the operating system under Android phones, cloud servers and supercomputers.

What the agents did

The pipeline used several kinds of agents, powered by an unreleased model OpenAI calls "an upcoming cyber model". Some scouted the code for possible bugs, some analysed them, and others tried to prove each one by actually triggering it in an isolated virtual machine.

The funnel looked like this:

Stage	Count
Possible bugs flagged	2,308
Reproduced as real	1,724
Distinct bugs with a working root exploit	948

Each of those exploits turns a normal user account into full admin (root). The agents produced 1,169 working exploits in total; 948 is the number of distinct bugs behind them.

The cost

The whole run cost $1,213,430 in API credits, which OpenAI calls more of an upper bound. Using historical bug bounty prices from Pwn2Own and TyphoonPWN, OpenAI puts a hypothetical value on the finds of $18.9M to $66.3M.

The good news

The same pipeline wrote candidate fixes. Human researchers reviewed the results and are reporting the bugs, with patches, to the Linux maintainers. Not all of them have shipped yet.

What this does and doesn't mean

• These are local bugs. An attacker needs a normal account, or code already running on the machine, first. This isn't a remote, zero-click hack.
• The exploits were tested on a common desktop Linux distribution. OpenAI didn't test them on Android phones.

The tile walls and funnel in the video are simplified illustrations. The text cards are exact quotes from OpenAI's post.

The warning worth remembering

OpenAI's own conclusion is blunt: on a device that isn't up to date, a normal account should be treated as functionally equivalent to root access for a well-resourced attacker. AI finds bugs faster now, and a fix only protects you once it's installed.

So turn on automatic updates on your phone and laptop tonight, and restart when they ask. The checklist above walks through it for Android, iPhone, Windows, Mac and Linux.