[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fD_yrN0UVjV8cEbVJ0pI1Bfds5ADnIMhfMlzVJydphOw":3},{"article":4,"iocs":43,"watch_terms":48,"solutions":49,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"15b8bfe0-5708-421f-ad5d-e9345ec527b2","OpenAI’s upcoming AI model built 948 working Linux root exploits in a single run","openai-s-upcoming-ai-model-built-948-working-linux-root-exploits-in-a-single-run-2bb4ac","An automated system running on an upcoming AI model turned hundreds of Linux kernel bugs into working exploits that give an ordinary user root access, and wrote a patch for each underlying flaw, OpenAI revealed in a new research post. Source:OpenAI The company’s Cyber team ran the pipeline in mid-October 2026 against the latest Linux kernel, with target machines running a stock desktop operating system from a commonly used distribution. The run ended with 948 … More → The post OpenAI’s upcoming AI model built 948 working Linux root exploits in a single run appeared first on Help Net Security.","OpenAI has developed an AI model capable of automatically discovering Linux kernel vulnerabilities and generating working root exploits. In a single run, the AI identified 948 distinct privilege escalation flaws, creating exploits and patches for each. This research highlights the potential for AI to significantly accelerate security research and exploit development.","OpenAI's AI model generated 948 Linux root exploits and patches for kernel bugs.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F05\u002Fopenai-linux-kernel-root-exploits\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002F08084556\u002Fopenai_robot-1500.webp","2026-11-05T09:05:06+00:00","2026-11-05T10:00:17.349551+00:00",9,[17,20,23],{"name":18,"type":19},"OpenAI","vendor",{"name":21,"type":22},"Linux kernel","technology",{"name":24,"type":22},"AI model","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":25,"icon":27,"name":28,"slug":29},null,"AI Security","ai-security",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44],{"type":45,"value":46,"context":47},"malware","Linux root exploits","AI-generated exploits for Linux kernel privilege escalation.",[18],{"controls":50,"vendors":134},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":81,"name":82,"problem":83,"products":84},"patch-management","Automated patch management","Known holes get closed in days, not months.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":42,"name":110,"problem":111,"products":112},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":130,"product_name":131,"url":132,"description":133},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":147},"ai-model-discovers-948-linux-root-exploits-in-one-run-raising-the-stakes-for-patch-velocity","AI Model Discovers 948 Linux Root Exploits in One Run, Raising the Stakes for Patch Velocity","OpenAI's new AI model autonomously discovered 948 distinct Linux kernel privilege escalation vulnerabilities and generated working root exploits for each in a single execution run, demonstrating how AI can dramatically compress the timeline between flaw discovery and weaponized exploit. This matters because historically, defenders relied on the relative slowness of manual exploit development to buy time for patching; AI eliminates that buffer. Organizations running unpatched Linux systems now face a threat landscape where exploit availability can precede patch deployment by an unprecedented margin. The asymmetry between AI-accelerated offensive capability and traditional defensive patching cycles represents a structural risk that demands urgent process changes.",[140,141,142,143,144,145,146],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":148,"NIST SP 800-53 SI-2: Flaw Remediation":149,"CIS Control 17: Incident Response Management":150,"OWASP A06:2021 Vulnerable and Outdated Components":151,"CIS Control 7: Continuous Vulnerability Management":152,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":153,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":154},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the AI-generated exploit research demonstrates why operators of critical infrastructure must have rapid-response patching processes for kernel-level vulnerabilities.","SI-2 requires organisations to identify, report, and correct information system flaws; the AI's ability to generate hundreds of working kernel exploits in one run underscores how critical timely flaw remediation is to preventing privilege escalation at scale.","If an AI-generated Linux kernel exploit is used in an attack, organisations need a pre-defined, rehearsed incident response plan that covers privilege escalation scenarios so they can contain and remediate quickly rather than improvising under pressure.","The Linux kernel is a critical software component, and running outdated kernel versions with known privilege escalation flaws is precisely the scenario A06 addresses, especially now that AI tools can enumerate and exploit those flaws automatically.","With 948 exploitable flaws potentially available to adversaries, continuous and prioritised scanning for Linux kernel CVEs—and enforcing patch SLAs—is exactly what this control mandates to close the window of exposure before AI-generated exploits can be weaponised.","This control explicitly requires organisations to obtain timely information about technical vulnerabilities and take measures to address them; AI-accelerated exploit generation makes the 'timely' requirement far more urgent than traditional patching cadences allow.","Privilege escalation exploits succeed by bypassing access controls; enforcing strict least-privilege and process isolation—as this framework area requires—limits how far a kernel exploit can be leveraged even when a patch is not yet available."]