A thousand fewer paths to root
- ID
- 43270
- Status
- summarized
- Published
- 05 Nov 2026, 7:33 AM
- Fetched
- 05 Nov 2026, 4:44 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://openai.com/index/a-thousand-fewer-paths-to-root/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.5
- Created
- 05 Nov 2026, 4:45 PM
- Tags
- Audience
- developersai_ml_learnersai_agent_userssaas_founders
What happened
OpenAI published a security post describing a prototype pipeline that statically scans the Linux kernel, dynamically reproduces findings in an isolated environment, generates PoC exploits and candidate patches, then hands results to human researchers. In a mid-October 2026 run using an "upcoming cyber model", it produced 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities, generated PoCs for 291 information-leak bugs and 948 working local privilege escalation exploits against a commonly used Linux distribution — at a total cost of $1,213,430 in API credits (~$1,279 per unit). OpenAI says it followed Linux kernel community guidance to start with critical issues and is working with Patch the Planet partners on reports and patches.
Why it matters
The headline number for a builder isn't 948 — it's the $1,279-per-result unit cost, which tells you agentic security scanning is now priced like a line item rather than a research project, so small teams can plausibly run it against their own code or kernels. Second, expect a wave of AI-generated kernel LPE reports and patch submissions hitting upstream maintainers and distro security teams; if you ship Linux-based appliances, VMs, or container images, plan for a heavier and noisier patch-review cycle, and treat vendor-supplied AI patches as untrusted until reviewed. Note this is OpenAI reporting on its own unreleased model, so the numbers are unverified.
Discussion angle
The pipeline's cost is the interesting part: ~$1,279 per validated exploit and $1.2M for one run — at what price point would you point an agent like this at your own codebase, and who reviews the output? Tie that to the maintainer side: 948 LPE patches arriving at once is a workload problem, not a win, so what disclosure throttle would you want if you maintained a distro?