HYPE OR FACT? · CHECKED 5 NOVEMBER 2026
OpenAI cyber pipeline: '948 Linux root exploits in one run'
OUR VERDICT
Partly factOur original verdict: “Fact or hype: partly fact. The blog, the methodology and the Patch the Planet context are real and public; every count and dollar figure is OpenAI's own, the upcoming cyber model isn't a product you can buy, and maintainers still have to accept the patches.”
THE CLAIM
“An upcoming OpenAI cyber model, run as an autonomous pipeline, dynamically reproduced 1,724 Linux vulnerabilities and produced 948 working local privilege-escalation exploits against a stock desktop OS at about $1.21 million in API cost (~$1,279 per exploit), inventing at least 10 novel techniques.”
What’s actually true
- OpenAI published a detailed research write-up at openai.com/index/a-thousand-fewer-paths-to-root describing the pipeline (find, prove, draft patch) and Patch the Planet partners.
- The 1,724 / 948 / $1.21M / ~$1,279 figures are OpenAI's own reported run from mid-October with an upcoming cyber model — not a product you can buy today.
- Human researchers reviewed findings before reporting; maintainers still have to accept patches.
- Thibault Sottiaux separately said OpenAI has assembled a world-class cyber team (opinion/context, not a product claim).
Sources
Cost
Not a product. Research only; the quoted API cost is OpenAI's for that internal run.
USE IT IF
Security and platform teams who need to understand how fast AI-assisted exploit discovery is moving, and Linux operators who should keep patching.
SKIP IT IF
Anyone looking for a buyable "cyber model" today, or treating OpenAI's dollar and exploit counts as independently audited.
How we knowChecked on 5 November 2026. Verdicts: Fact = the claim holds up; Partly fact = real, but with caveats or overstated parts; Hype = the headline claim isn't supported. Products change quickly, so check the maker's site before you buy. Our methods & sources ↗