--- title: they found 1000 vulnerabilities in the linux kernel.. description: OpenAI found and fixed roughly 1,000 local privilege escalation bugs in the Linux kernel, spending about $1.2 million, or roughly $1,200 per bug. The project,... canonical: https://daily.dev/posts/they-found-1000-vulnerabilities-in-the-linux-kernel--vaaymp79t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: they found 1000 vulnerabilities in the linux kernel.. | daily.dev og:description: OpenAI found and fixed roughly 1,000 local privilege escalation bugs in the Linux kernel, spending about $1.2 million, or roughly $1,200 per bug. The project,... og:url: https://daily.dev/posts/they-found-1000-vulnerabilities-in-the-linux-kernel--vaaymp79t og:image: https://api.daily.dev/og/posts/vAAymP79t.png og:image:alt: they found 1000 vulnerabilities in the linux kernel.. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # they found 1000 vulnerabilities in the linux kernel.. **[Low Level Learning](https://daily.dev/sources/lowlevellearning)** · 14 min read · 2 upvotes · 0 comments ## Summary OpenAI found and fixed roughly 1,000 local privilege escalation bugs in the Linux kernel, spending about $1.2 million, or roughly $1,200 per bug. The project, called Patch the Planet, is run with Trail of Bits. Agents are split into roles: scout agents scan the 40-million-line kernel for suspicious code patterns, analyst agents dig into smaller audit targets of around 10k lines, and triage agents build proof-of-concept exploits to confirm real bugs. Out of 2,300 candidates, about 1,700 were real findings, including 313 memory leaks and 948 working LPEs. A model called GPT-5.6 with added 'skills' reportedly performed about 20% better than GPT-5.5 without them. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### how many local privilege escalation bugs did OpenAI find in the Linux kernel OpenAI found and fixed 948 working local privilege escalations in the Linux kernel, out of 1,200 LPE candidates identified from 2,300 total candidates. The effort, called Patch the Planet and run with Trail of Bits, also turned up 313 memory leak bugs with 219 working leak proof-of-concepts, and cost about $1.2 million total. _developers weighing AI-driven security audits can track findings like this one on daily.dev._ ### how does OpenAI's AI agent pipeline find vulnerabilities in a codebase as large as the Linux kernel The pipeline splits work across agent roles because a single model's context window can't hold the kernel's 40 million lines of code. Scout agents survey the whole codebase for suspicious patterns like ring buffers or page cache logic, flagging audit targets of around 10,000 lines or fewer. Analyst agents then do deep vulnerability research on those smaller targets, and triage agents build proof-of-concept exploits in a VM to confirm real bugs before a patch is written. _engineers scaling AI code review across large codebases can follow approaches like this on daily.dev._ ### does adding skills improve GPT-5 model performance on vulnerability research tasks Yes, GPT-5.6 with added skills performed almost 20% better than GPT-5.5 without skills on vulnerability research tasks, according to a graph from OpenAI's kernel bug-hunting report. This suggests that equipping frontier models with task-specific skills meaningfully boosts their effectiveness at finding real security bugs in large codebases like the Linux kernel. _teams evaluating which AI model setup fits their security workflow can follow these comparisons on daily.dev._ --- Tags: [#linux](https://daily.dev/tags/linux), [#openai](https://daily.dev/tags/openai), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/they-found-1000-vulnerabilities-in-the-linux-kernel--vaaymp79t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"they found 1000 vulnerabilities in the linux kernel..","url":"https://daily.dev/posts/they-found-1000-vulnerabilities-in-the-linux-kernel--vaaymp79t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/they-found-1000-vulnerabilities-in-the-linux-kernel--vaaymp79t"},"datePublished":"2026-11-12T14:20:15.540Z","dateModified":"2026-11-12T14:20:47.216Z","description":"OpenAI found and fixed roughly 1,000 local privilege escalation bugs in the Linux kernel, spending about $1.2 million, or roughly $1,200 per bug. The project,...","image":"https://i.ytimg.com/vi/Z3xvjzlDWd8/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/Z3xvjzlDWd8/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Low Level Learning","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Low Level Learning","logo":"https://media.daily.dev/image/upload/s--pjLyMMmx--/f_auto/v1724394406/logos/lowlevellearning","url":"https://daily.dev/sources/lowlevellearning"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/they-found-1000-vulnerabilities-in-the-linux-kernel--vaaymp79t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,openai,vulnerability","timeRequired":"PT14M","video":{"@type":"VideoObject","name":"they found 1000 vulnerabilities in the linux kernel..","description":"OpenAI found and fixed roughly 1,000 local privilege escalation bugs in the Linux kernel, spending about $1.2 million, or roughly $1,200 per bug. The project,...","thumbnailUrl":"https://i.ytimg.com/vi/Z3xvjzlDWd8/sddefault.jpg","uploadDate":"2026-11-12T14:20:15.540Z","duration":"PT14M","url":"https://api.daily.dev/r/vAAymP79t","embedUrl":"https://www.youtube.com/embed/Z3xvjzlDWd8"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Low Level Learning","item":"https://daily.dev/sources/lowlevellearning"},{"@type":"ListItem","position":3,"name":"they found 1000 vulnerabilities in the linux kernel.."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/they-found-1000-vulnerabilities-in-the-linux-kernel--vaaymp79t#faq","mainEntity":[{"@type":"Question","name":"how many local privilege escalation bugs did OpenAI find in the Linux kernel","acceptedAnswer":{"@type":"Answer","text":"OpenAI found and fixed 948 working local privilege escalations in the Linux kernel, out of 1,200 LPE candidates identified from 2,300 total candidates. The effort, called Patch the Planet and run with Trail of Bits, also turned up 313 memory leak bugs with 219 working leak proof-of-concepts, and cost about $1.2 million total. developers weighing AI-driven security audits can track findings like this one on daily.dev."}},{"@type":"Question","name":"how does OpenAI's AI agent pipeline find vulnerabilities in a codebase as large as the Linux kernel","acceptedAnswer":{"@type":"Answer","text":"The pipeline splits work across agent roles because a single model's context window can't hold the kernel's 40 million lines of code. Scout agents survey the whole codebase for suspicious patterns like ring buffers or page cache logic, flagging audit targets of around 10,000 lines or fewer. Analyst agents then do deep vulnerability research on those smaller targets, and triage agents build proof-of-concept exploits in a VM to confirm real bugs before a patch is written. engineers scaling AI code review across large codebases can follow approaches like this on daily.dev."}},{"@type":"Question","name":"does adding skills improve GPT-5 model performance on vulnerability research tasks","acceptedAnswer":{"@type":"Answer","text":"Yes, GPT-5.6 with added skills performed almost 20% better than GPT-5.5 without skills on vulnerability research tasks, according to a graph from OpenAI's kernel bug-hunting report. This suggests that equipping frontier models with task-specific skills meaningfully boosts their effectiveness at finding real security bugs in large codebases like the Linux kernel. teams evaluating which AI model setup fits their security workflow can follow these comparisons on daily.dev."}}]} ```