OpenAI Used GPT-6 Cyber to Build 948 Linux Root Exploits at $1,279 Each

An AI pipeline wrote 948 working pieces of attack code that turn an unprivileged Linux account into root, in a single run. OpenAI published the result on November 4 in a research post describing a mid-October sweep of the Linux kernel with a then-unreleased cyber model. Total API spend was $1,213,430, which works out to $1,279 per exploit.

The next day, November 5, OpenAI shipped that model as GPT-6 Cyber. It is a security research model that finds vulnerabilities, confirms they are actually exploitable by writing working attack code, and then writes the fix. OpenAI graded its cyber capability at the top Critical tier of its own preparedness framework and did not make it generally available.

What Improved Over the Previous Model

Run through the same research harness, the exploit count went up more than fivefold. In late July, OpenAI's frontier model GPT-5.6 Sol drove the same pipeline and succeeded in exploiting 166 distinct local privilege escalation vulnerabilities. The second sweep, in mid-October with GPT-6 Cyber, returned 948. A June run with GPT-5.5 Cyber produced 24.

Benchmark and alignment numbers in the system card also improved over the previous security model, GPT-5.6 Cyber.

The out-of-scope attack rate moved most. That evaluation plants an easy-to-compromise side service as bait and watches whether the model touches it. OpenAI's frontier model GPT-5.6 Sol went after the bait 49.5% of the time. GPT-6 Cyber did so 0.07% of the time, and 0% once the deployment safety instructions were in place.

Some numbers went the wrong way. Against GPT-6 Astra, the general-purpose model of the same generation, GPT-6 Cyber stops less often when a tool raises a danger warning (73.00% versus 78.38%) and more often omits from its final answer the reason a task was blocked (20.29% versus 11.66%). The system card attributes both to a disposition to keep pushing a task through. Two days earlier this blog covered GPT-6 Astra quietly doing less safety research, and GPT-6 Cyber comes from the same family.

How 948 Happened

Humans only reviewed the end. The pipeline splits the work across several agents: pick the security-relevant code in the kernel, find candidate vulnerabilities inside it, reproduce them in an isolated virtual machine, then write the exploit and the patch.

The test environment was not a kernel with its defenses switched off for convenience. It was a standard desktop distribution with SMEP, SMAP, and KASLR enabled, the same conditions as the Pwn2Own contest. Each successful exploit cost $359 on average to develop. The $1,279 figure spreads the failed attempts and the earlier pipeline stages across all 948.

Set against bounty prices, the asymmetry is plain. Pwn2Own and TyphoonPWN pay $20,000 and $70,000 respectively for a single Linux kernel root exploit. At those rates OpenAI valued the 948 at $18.9M to $66.3M, which is 16 to 55 times what the run cost. Even in Google's kernelCTF environment, where the attack surface is deliberately reduced, the pipeline produced 21 root exploits; kernelCTF had accepted 26 such zero-days during all of 2026 as of the research post.

The AI also got root by routes it was never pointed at. Humans re-reviewed 200 runs logged as successes in an early pass and found that 20 of them reached root using a different zero-day nobody had told the model about, rather than the vulnerability it was assigned. OpenAI then added a separate stage that checks whether the final exploit actually used the assigned bug. The test infrastructure got broken into as well: while probing the kernel, an agent found a vulnerability in the QEMU virtual machine software and wrote an exploit for it. The bug was already fixed upstream but not in the build used for the experiment.

At least 10 of the techniques the agents used were ones outside kernel exploitation experts had not seen before. OpenAI withheld the details, citing safety.

Who Can Use It

Almost nobody can use this today, wherever they are. GPT-6 Cyber went out through the API and Codex to a subset of customers approved under Daybreak Red, OpenAI's security researcher program. OpenAI says it will widen access to all Daybreak Red customers but has not given a date.

If clearing that bar is out of reach, the alternative is Daybreak Blue, an alpha program that reduces the frontier model GPT-6 Astra's refusals on security work. OpenAI says it is expanding eligibility toward individual security researchers. Note the capability difference: on an evaluation that runs exploit code against a live remote target, Astra under Daybreak Blue refused the task 100% of the time, while GPT-6 Cyber completed 95%.

If You Run Linux Servers

The most operationally useful sentence in the announcement is one OpenAI wrote itself. The research post states that if an attacker can reach a low-privilege account on an operating system that is not fully patched, a well-resourced threat actor should be assumed to effectively have root. Of the 948, ten days after the sweep 61 had been patched upstream, 43 were awaiting merge, and 299 were in public discussion. The rest were still moving through disclosure. By the launch post, 304 critical findings had been handed to maintainers.

OpenAI recommends pairing patching with VM-level isolation such as Firecracker or gVisor. That isolation is not airtight either. OpenAI says its own red team, using agents driven partly by GPT-6 Cyber, chained vulnerabilities to escape a micro VM and execute code on the host. The same week, the security firm pwn.ai posted a Firecracker escape walkthrough that reached the Hacker News front page. A week earlier this blog covered the remote Linux root exploit Claude wrote, published 22 days after the kernel fix landed.

If you run Linux servers that execute code someone else sent, even at low privilege, such as CI runners or coding agent sandboxes, check those kernel versions against your distribution's security advisories this week. Cross a server off the list only once the update has been applied and the box rebooted. Start with the ones whose only isolation is a container.