The autonomous vulnerability discovery, exploitation, and patching pipeline operated by OpenAI spent $1,213,430 in API credits during a mid-October 2026 run, averaging an infrastructure cost of $1,279 per working local privilege escalation exploit. This test replaced manual vulnerability investigations with an automated pipeline that scanned Linux kernel targets, reproduced flaws dynamically, constructed exploits, and proposed remediations. As OpenAI demonstrated, security auditing now functions as a systematic pipeline governed by explicit unit economics.
Automating cyber audits establishes a measurable unit cost for vulnerability discovery and patching. In this prototype deployment, OpenAI's system analyzed 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities, and yielded 948 working local privilege escalation exploits alongside 291 information leak proofs-of-concept.
The Economics of Automated Exploitation
The pipeline identified audit targets in the Linux kernel via static scans before moving them into isolated dynamic execution environments. Once an issue reproduced, the model synthesized an exploit to confirm privilege escalation to root, drafted a candidate patch, and handed the full dossier to human researchers. Operating stock desktop operating systems under threat models aligned with security competitions, the pipeline bypassed the manual labor traditionally required to confirm kernel severity.
"Applying those historical bounty amounts to the 948 exploits produces a hypothetical valuation of $18.9M—$66.3M, approximately 16x to 55x our pipeline’s cost."
Historical bounty rewards from competitions like Pwn2Own and TyphoonPWN, which offered $20,000 and $70,000 for Linux kernel local privilege escalation exploits, value that output at $18.9 million to $66.3 million.
Shifting Bottlenecks in Kernel Auditing
Scale brings operational friction to downstream maintainers. The pipeline's run across an adapted kernelCTF environment with a reduced attack surface cost $32,936 in API credits, producing 25 information leak proofs-of-concept and 21 local privilege escalation exploits. For context, 26 confirmed zero-day local privilege escalation exploits had been accepted by kernelCTF throughout 2026 at the time of writing.
"To the best of our knowledge, the agents in this pipeline discovered and used at least 10 novel Linux exploitation techniques."
The system demonstrated technical depth beyond known scripts, discovering at least 10 novel Linux exploitation techniques. Model capabilities progressed rapidly across iterations: in June, GPT-5.5 Cyber had developed 24 local privilege escalation exploits under the Patch the Planet initiative, whereas the mid-October cyber model found more than five times more novel local privilege escalations than a GPT-5.6 Sol run completed in July. Meanwhile, maintainers were already actively closing flaws: over 100 Linux local privilege escalations received patches or staging fixes within the 10 days the scan was active, while roughly 300 more entered public technical discussions.
Can open-source maintainers absorb hundreds of automated patches generated at $1,279 per exploit without having their validation queues overwhelmed by the volume of machine-generated findings?
For comparison
According to company figures, producing a verified root exploit now costs an average of $1,279 in compute, leaving open-source maintainers to process an unprecedented flood of machine-generated reports with traditional manual workflows. Can open-source maintainers verify hundreds of machine-generated patches before identical $1,279 exploits surface in the wild?