On November 5, patches—948 in total—arrived in Linux kernel maintainers’ inboxes, all generated by a single OpenAI automation pipeline. In just over thirty hours, an AI “hacker army” combed through over 40 million lines of kernel code—maintained for thirty years by the world’s top programmers—uncovering 1,169 vulnerabilities, each with working exploit code capable of obtaining root privileges.
This is neither a drill nor an experiment in a research lab. OpenAI publicly announced this initiative under the banner “Patch the Planet”:Fully nonprofit, free of charge, with results delivered directly to upstream maintainers.For defenders, this is good news; for security professionals accustomed to thinking “AI only writes phishing emails,” it demands a fundamental recalibration.
I. What actually happened:ChatGPT Cyber launched
On November 5, OpenAI announced Daybreak Red opening access to a new cybersecurity-specific model for its highest-tier plan users ChatGPT CyberDaybreak is OpenAI’s security research initiative, offered in two tiers: Blue for defenders (vulnerability remediation, code auditing) and Red for offensive security research (vulnerability discovery, exploit development)
The day before, OpenAI had already showcased its results: using the same model to scan the Linux kernelidentified 948 potential security issues; scanning FirefoxFirefox uncovered 81 previously unrecorded “novel” vulnerabilities. The Linux-related findings have been compiled into patch recommendations submitted upstream; Firefox reportedly assisted in fixing over 40 of them
A notable positioning distinction: this is not a general-purpose model intended for ordinary users. To access it, one must first join the Daybreak program and submit government-issued identification for identity verificationThe number of people who can obtain it is vastly disproportionate to those who can access open-source, unguarded models— This is the most controversial aspect of the entire initiative, discussed further below
II. The AI hacker force’s division of labor: four roles, one assembly line
What truly merits attention is not “AI found vulnerabilities,” but how it orchestrates the process. OpenAI built a four-stage assembly line, with each stage handled by agents assigned distinct responsibilities—and both cost and output meticulously quantified
- Scoutreads through over 40 million lines of kernel code to identify security-relevant, attack-prone sections. It ultimately isolates 2.8 million lines of “high-value targets”—roughly 7% of total code—costing $3,426 in API credits
- Analystconducts exhaustive scanning of the 2.8 million lines flagged by the Scout. It delivers 2,308 “suspected vulnerability” reports within 12 hours, at a cost of $316,000
- TriageAutomatically generate PoCs for each report and run them in isolated VMs to verify whether they can actually crash the system. Reproduced 1,724 kernel crashes within 30 hours, achieving a 74.7% success rate—this figure is critical, indicating that most reports are not hallucinations.
- ExploitDevAttempt to bypass protections such as SMEP, SMAP, and KASLR to achieve root access. Ultimately produced 291 information-leak PoCs and 1,169 functional privilege-escalation exploits, with an average API cost of $359 per exploit.
Total cost for the entire pipeline: $1.2 millionAveraging$1,279 per vulnerability across 948 vulnerabilitiesValuing these 948 vulnerabilities against historical Pwn2Own competition prize money yields a market range of approximately $18.9 million to $66.3 million.
III. Why this effort is not on the same scale as the one conducted three months ago
In July, OpenAI scanned the same codebase using GPT-5.6 Sol: spending over $500,000 and identifying 166 vulnerabilities.Three months later, switching to a specialized security model increased costs by only 2.4× while increasing results by 5.7×.Prior to this, top-tier human security researchers typically discovered around 20 vulnerabilities of comparable severity in the Linux kernel per year.
Another detail—more chilling than the numbers—is this: during early testing, the security team assigned ExploitDev specific vulnerabilities and considered the task complete upon obtaining a root shell. Yet among 200 completed cases, manual verification revealed 20 exploits did not use the assigned vulnerability at all—the agent, operating within its constrained target environment, repeatedly probed the system, determined the assigned vulnerability was intractable, and instead independently discovered an entirely unknown 0-day elsewhere in the system, then leveraged it all the way to root.
This behavior was not taught; it emerged autonomously as a goal-driven shortcut.
IV. What this means for defenders
The security community has long held that “offense-defense asymmetry” is fundamental: attackers need only succeed once, while defenders must succeed every time. AI further flattens this curve—attackers’ marginal cost has dropped to over $1,000 per vulnerability, whereas defenders’ human auditing costs remain virtually unchanged.
This is also where controversy lies. Some researchers point out that OpenAI recently deprecated Daybreak Blue Nerfed once(nerf), making it less effective at finding vulnerabilities. The stated reason sounds noble: preventing misuse by bad actors. But defenders complain they’re fighting with one hand tied while others freely run open-weight models against their perimeter.
At the same time, Google promoted its cybersecurity-specialized Gemini 4 Argon model, while Anthropic released a free OSS Scanner tool to help open-source projects find vulnerabilities; the three companies even jointly published a rare AI Cyber Defense InitiativeTheir direction is aligned:Fix known vulnerabilities before attackers exploit them.
V. What ordinary users and companies should do now
- Shorten patch SLAsWhat used to be acceptable—quarterly patching—is no longer viable, given that critical kernel vulnerabilities are now discovered on a weekly basis; automate wherever possible.
- Principle of least privilege over perimeter defenseMost of these vulnerabilities enable escalation from low-privilege accounts to root; an unpatched regular account effectively becomes the key to the entire machine. Never run services as root.
- Monitor kernel and foundational library versionsLow-level components like the Linux kernel, glibc, and OpenSSL have system-wide impact when compromised—maintain a dedicated asset inventory for them.
- Reduce attack surfaceAvoid exposing services to the public internet unless absolutely necessary. AI-powered vulnerability scanning has become cheap enough to run “as a matter of course.”
- Backups and immutable snapshotsWhen privilege escalation becomes inexpensive, recovery capability is the final line of defense.
As for the role of open-source models in this context, consider Qwen3.8-Flash-Next leak exposedThat discussion and DeepSeek V4 Pro their open-weight approach—greater openness implies greater security responsibility shifted onto users.
Summary: This time, the hammer is in the hands of the fixers.
In one sentence:AI has transformed “discovering kernel 0-day vulnerabilities” from a craft requiring months of expertise into a production-line operation costing several dollars per minute.This time, the hammer is in the hands of the fixers, so Linux users benefit; but technology has no stance—swap the operator, and the same production line becomes something else entirely. The only variable ordinary users can control is “how up-to-date your system is.”
To keep up with comparative capabilities of leading AI security models and cutting-edge models, see our AI Model Library and Tool Comparison Engineor read these two foundational evaluations directly:ChatGPT Deep Review and Claude Deep Review,as well as Full Review List.
Frequently Asked Questions (FAQ)
ChatGPT What is Cyber? Can ordinary users use it?
It is OpenAI’s cybersecurity-specific model, currently available only to top-tier Daybreak Program users (Daybreak Red—offensive security research); enrollment requires identity verification. Ordinary ChatGPT subscribers cannot access it,ChatGPT and there is no entry point in the interface.
Have these 948 Linux vulnerabilities already been exploited?
There is no public evidence of exploitation. These issues were submitted to upstream maintainers and projects like Debian as patch recommendations, following the standard responsible disclosure process—fix first, disclose later. However, note that the exploit code included in the report is fully functional; leakage poses real risk.
Is $1.2 million for 948 vulnerabilities expensive or cheap?
It is extremely cheap by bug bounty market standards. At an average of $1,279 per vulnerability and $359 per usable root privilege escalation exploit, the batch’s value would range from $18.9 million to $66.3 million in competitions like Pwn2Own.
How should ordinary developers respond to the AI-powered vulnerability discovery era?
Prioritize three actions: reduce kernel and core library patch cycles to weekly, avoid running services as root and enforce least-privilege isolation, and minimize publicly exposed attack surfaces wherever possible. AI has made “casually scanning” prohibitively cheap—relying on “nobody will target me” is no longer viable.
Why is the security community sharply divided on this issue?
Because capability is a double-edged sword. Defenders receive a free vulnerability list, yet simultaneously confirm that the attack threshold has dropped to “a few thousand dollars can yield several usable exploits.” Coupled with restrictions on cutting-edge models’ usage and the unrestricted circulation of open-source, unguarded models, practitioners perceive a resource imbalance between attackers and defenders.