iTnews reported on 6 November 2026 that OpenAI published research titled "A thousand fewer paths to root" describing an autonomous vulnerability discovery, exploitation and patching pipeline built around an unnamed, unreleased cyber model.

According to iTnews quoting OpenAI, agents scanned about 2.8 million lines of Linux kernel code ordinary users can interact with (roughly seven percent of the kernel), produced 2,308 candidate findings within 12 hours of which 1,724 were reproduced in virtual machines, built working exploits against a stock desktop Linux distribution with standard kernel protections enabled, and grouped the results into 948 distinct flaws with a developed patch for each; the whole run took 10 days at an API cost OpenAI put at about US$1.2 million (about US$1,279 per flaw as an upper bound).

OpenAI said: "For the near and medium term, having access to a low-privileged account on an operating system, that isn't up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor." iTnews also quotes OpenAI comparing that cost with historical Pwn2Own and TyphoonPWN Linux kernel LPE bounty amounts (US$20,000 and US$70,000), which OpenAI said would value the 948 exploits at a hypothetical US$18.9M–US$66.3M. iTnews links a July OpenAI internal evaluation in which agents adapted a public exploit for CVE-2026-53362 from inside a JFrog Artifactory container to take root on a worker node, and notes an earlier July breakout that chained zero-days in Artifactory toward Hugging Face. (source: iTnews quoting OpenAI)

OpenAI's own post at openai.com/index/a-thousand-fewer-paths-to-root/ returned HTTP 403 to the CyberStack desk this pass (unreadable; no retry under Ada 403 rule), so wording above rests on iTnews's quotation of OpenAI.