OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run
Hour Run has published findings on a flaw in how OpenAI-style agents handle untrusted input.
Hour Run has published findings on a flaw in how OpenAI-style agents handle untrusted input.
OpenAI on Wednesday detailed a pipeline that employed an upcoming cyber-focused artificial intelligence (AI) model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2 million in API costs.
The findings build upon 24 LPE exploits that OpenAI revealed were discovered by its GPT‑5.5‑Cyber model back in June 2026.
To the best of our knowledge, the agents in this pipeline discovered and used at least 10 novel Linux exploitation techniques. cost prohibitive for bad actors to exploit software.
In a report published last month, VulnCheck categorized AI-assisted vulnerability discovery as a growing risk category that turbocharges novice hackers, who now require little to no technical expertise to detect software vulnerabilities.
The access to AI models is not just limited to defenders, but also bad actors who can leverage the same capabilities to discover and weaponize new zero-days and expand the pool of viable targets with minimal effort.
Any organization running OpenAI-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
However, without correct and widespread configuring of this technology, many systems are still vulnerable to attackers using AI-cyber tools to identify and exploit system weaknesses. The NCSC also pointed out that organizations will have to evolve their internal patching and testing processes to meet this new pace of vulnerability discovery.
The danger here is that the exfiltration path hides inside normal business activity, so a control built to catch obvious attacks has nothing unusual to flag.
The number of vulnerabilities classified as high-risk has surged from 131 disclosures in January 2026 to 350 in August 2026, a 167% growth.
Hour Run's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
The total run cost $1,213,430 in API credits, or $1,279 per LPE exploit.
According to insights from Google Threat Intelligence Group (GTIG), the number of vulnerabilities disclosed per month has more than doubled, rising from 5,045 in January 2026 to 10,740 in August 2026.
Defensive AI-cyber tools have reduced the window of a vulnerability moving from zero-day to an N-day vulnerability, and have made patching a quicker process.
OpenAI said the rate of vulnerability discovery by frontier models needs to be matched by automated patch generation to secure software and to limit the exploitation window.
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.
What happened
Hour Run has published findings on a flaw in how OpenAI-style agents handle untrusted input.
OpenAI on Wednesday detailed a pipeline that employed an upcoming cyber-focused artificial intelligence (AI) model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2 million in API costs.
The findings build upon 24 LPE exploits that OpenAI revealed were discovered by its GPT‑5.5‑Cyber model back in June 2026.
What changed
To the best of our knowledge, the agents in this pipeline discovered and used at least 10 novel Linux exploitation techniques. cost prohibitive for bad actors to exploit software.
In a report published last month, VulnCheck categorized AI-assisted vulnerability discovery as a growing risk category that turbocharges novice hackers, who now require little to no technical expertise to detect software vulnerabilities.
The access to AI models is not just limited to defenders, but also bad actors who can leverage the same capabilities to discover and weaponize new zero-days and expand the pool of viable targets with minimal effort.
Who is affected
Any organization running OpenAI-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
However, without correct and widespread configuring of this technology, many systems are still vulnerable to attackers using AI-cyber tools to identify and exploit system weaknesses. The NCSC also pointed out that organizations will have to evolve their internal patching and testing processes to meet this new pace of vulnerability discovery.
Why it matters
The danger here is that the exfiltration path hides inside normal business activity, so a control built to catch obvious attacks has nothing unusual to flag.
The number of vulnerabilities classified as high-risk has surged from 131 disclosures in January 2026 to 350 in August 2026, a 167% growth.
Technical details
Hour Run's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
The total run cost $1,213,430 in API credits, or $1,279 per LPE exploit.
According to insights from Google Threat Intelligence Group (GTIG), the number of vulnerabilities disclosed per month has more than doubled, rising from 5,045 in January 2026 to 10,740 in August 2026.
Response
Defensive AI-cyber tools have reduced the window of a vulnerability moving from zero-day to an N-day vulnerability, and have made patching a quicker process.
OpenAI said the rate of vulnerability discovery by frontier models needs to be matched by automated patch generation to secure software and to limit the exploitation window.
What security teams should do
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.