Threat reportVulnerabilityTL-2026-5289
OpenAI Cyber Model Uncovers 948 Linux Kernel Local Privilege Escalation Vulnerabilities
OpenAI reported that an automated, multi-agent research pipeline built on an upcoming cyber model found 948 unique Linux kernel local privilege escalation bugs that let a normal local user gain root. Proof-of-concept code was built and reproduced in isolated VMs, and upstream patching began within 10 days; no CVE IDs, CVSS scores or in-the-wild exploitation are reported in the source.
Key facts for Linux kernel LPE pipeline
| Identifiers | TL-2026-5289 |
|---|---|
| Also known as | Patch the Planet, A thousand fewer paths to root |
| Severity | HIGH |
| First disclosed | |
| Exploitation status | Public proof-of-concept exploit |
| Affected products | Linux Kernel Organization Linux kernel |
| Malware | root |
| Tools | GPT-5.5-Cyber, GPT-5.6 Sol, Kernel Address Sanitizer, OpenAI upcoming cyber model |
| MITRE ATT&CK techniques | T1078 Valid Accounts, T1587.004 Develop Capabilities: Exploits, T1588.005 Obtain Capabilities: Exploits, T1588.006 Obtain Capabilities: Vulnerabilities |
| Motivation | UNKNOWN |
| Target sectors | technology, cloud, government administration, finance, telecoms |
| Target regions | Global |
| Detection rules | 9 (1 shown free) |
| Sources | 5 cited sources |
Detection coverage for Linux kernel LPE pipeline
As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5289 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Linux Kernel LPE (TL-2026-5289) - Root Process Spawned by Non-Root Parent Outside Privilege Brokers
Detects the core behaviour of the 948 Linux kernel local privilege escalation bugs in TL-2026-5289: an unprivileged process gaining uid 0 and spawning a root child without going through sudo, su, pkexec, sshd or another setuid broker. A kernel LPE exploit (commit_creds style) leaves a root shell or helper whose parent still runs as the low-privileged account. A low-privileged valid account on an unpatched Linux kernel host should be treated as root-equivalent, so this is the highest-value hunt for the disclosure. No CVEs are published, so detection is behavioural rather than signature based.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1068, T1078
- Data sources: sysmon_for_linux, linux_process_creation, microsoft_defender_for_endpoint_linux
- Severity: high
- Confidence: medium
Splunk SPL
index=linux sourcetype="sysmon:linux" EventCode=1 User=root ParentUser=* NOT ParentUser=root NOT ParentImage IN ("/usr/bin/sudo","/usr/bin/su","/bin/su","/usr/bin/pkexec","/usr/sbin/sshd","/usr/bin/passwd","/usr/bin/newgrp","/usr/bin/crontab","/usr/sbin/cron","/usr/lib/polkit-1/polkit-agent-helper-1")
| eval threat_id="TL-2026-5289"
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as root_children values(CommandLine) as cmdlines by threat_id host ParentUser ParentImage
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountName == "root"
| where isnotempty(InitiatingProcessAccountName) and InitiatingProcessAccountName != "root"
| where InitiatingProcessFileName !in~ ("sudo", "su", "pkexec", "sshd", "passwd", "newgrp", "crontab", "cron", "login", "polkit-agent-helper-1")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| order by Timestamp descSigma
title: Root Process Spawned by Binary in User-Writable Path - Linux Kernel LPE
id: 3b7e1c4a-6d52-4f0e-8a19-c2d5e7f10a01
status: experimental
description: Detects a root process whose parent executable lives in a user-writable directory (/tmp, /dev/shm, /var/tmp, /home, /run/user). This is the typical shape of a local kernel privilege escalation exploit (TL-2026-5289) that gains uid 0 and spawns a root shell or helper.
references:
- https://cybersecuritynews.com/openai-uncovers-948-linux-kernel-vulnerabilities/
- https://google.github.io/security-research/kernelctf/rules.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
- attack.privilege-escalation
- attack.initial-access
- attack.t1068
- attack.t1078
logsource:
category: process_creation
product: linux
detection:
selection:
User: 'root'
ParentImage|startswith:
- '/tmp/'
- '/dev/shm/'
- '/var/tmp/'
- '/home/'
- '/run/user/'
condition: selection
falsepositives:
- Administrators running self-built tools from a home directory after switching to root
- Software installers executed from /tmp as root
level: high
Known false positives:
- Legitimate setuid helpers or login/session managers not in the exclusion list that start root children from a user context
- Administrators using custom privilege wrappers (doas, sudo-rs, ksu) that Sysmon records with a non-root ParentUser
Tuning notes: Add site-specific privilege brokers (doas, ksu, sudo-rs, container runtimes) to the ParentImage exclusion list after a 7-day baseline. The Sigma variant is a narrower high-fidelity form that only fires when the parent runs from a user-writable path; Sigma cannot compare ParentUser to User. Confirm that your Sysmon for Linux build emits ParentUser; if not, switch to auditd SYSCALL records correlated by ppid.
- Exploit Compiled in Temp Directory Followed by Root Process - TL-2026-5289 Kernel LPE Staging · unlock with TL Creds
- Public Exploit / PoC Download via curl, wget or git on Linux Host - TL-2026-5289 · unlock with TL Creds
- Unprivileged User Namespace Creation via unshare by Non-Root User - TL-2026-5289 · unlock with TL Creds
- Root Process Spawned from User-Writable Path Parent - Kernel LPE Exploit Execution (TL-2026-5289) · unlock with TL Creds
- Setuid Bit Set on Shell or Temp-Path Binary - Post-Exploitation Root Persistence (TL-2026-5289) · unlock with TL Creds
- Container or Sandbox Escape to Host Namespaces After Kernel LPE (nsenter / Privileged Container) - TL-2026-5289 · unlock with TL Creds
- Kernel Pointer Leak Reconnaissance by Unprivileged User (KASLR Defeat) - TL-2026-5289 · unlock with TL Creds
- Kernel Oops / KASAN / Panic on Production Host - Failed Kernel Exploit Attempt (TL-2026-5289) · unlock with TL Creds
Indicators of compromise for Linux kernel LPE pipeline
As of 2026-11-05, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5289.
How Linux kernel LPE pipeline works
Cyber Security News (2026-11-05) summarizes OpenAI research describing an October 2026 run of an automated vulnerability-research pipeline using an upcoming, unnamed OpenAI cyber model. Scout agents identified 5,034 audit targets covering about 2.8 million lines of kernel code (roughly 7% of the kernel). Analyst agents produced 2,308 candidate findings in 12 hours. Triage agents then built proof-of-concept code and tested it in isolated virtual machines with Kernel Address Sanitizer; 1,724 findings (74.7%) reproduced. About 3.1% of findings were false positives caused by impossible conditions. Variant analysis deduplicated the results down to 948 unique local privilege escalation bugs, and human review verified results before reporting.
Exploit agents generated 291 information-leak proofs and 1,169 working privilege escalation exploits, and tested them against SMEP, SMAP, KASLR and HARDENED_USERCOPY. On a hardened kernelCTF-style setup the pipeline produced 21 privilege escalation exploits at a cost of $32,936. Total API cost was reported as $1,213,430 (about $1,279 per exploit), with an estimated value of $18.9 million to $66.3 million when compared with public bounty programs (Pwn2Own at $20,000, TyphoonPWN at $70,000, kernelCTF at $71,337 per eligible exploit). A prior July run with GPT-5.6 Sol found 166 unique bugs.
Remediation progress: 948 patches were written. Within 10 days, 61 bugs were patched upstream, 43 had staged patches and 299 were under public discussion. The source article gives no CVE identifiers, no CVSS data and no affected kernel version ranges. It does not report in-the-wild exploitation. The severity of HIGH is an analyst estimate for local-to-root privilege escalation with reproduced PoCs. The article's defensive takeaway is that a low-privileged account on an unpatched system should be treated like root access for a well-funded threat actor. Recommended mitigations are prompt kernel updates followed by a reboot, limiting unprivileged user namespaces, and sandboxing with Firecracker or gVisor. The article ties the work to OpenAI's Patch the Planet (launched June 2026) and Daybreak programs and to the blog post 'A thousand fewer paths to root'. The OpenAI primary posts could not be retrieved (HTTP 403), so figures here rely on the secondary article and the Google kernelCTF rules page.
MITRE ATT&CK techniques by tactic:
Initial Access
Resource Development
T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities
Remediation for Linux kernel LPE pipeline
Patches
- 61 bugs patched upstream, 43 with staged patches and 299 under public discussion within 10 days; no CVE IDs published in the source
Immediate actions
- Install Linux kernel updates promptly as upstream and distribution patches ship, and reboot into the new kernel
- Treat a low-privileged account on an unpatched host as equivalent to root access when prioritizing patching
- Limit unprivileged user namespaces where they are not required
Workarounds
- Restrict unprivileged user namespaces
- Isolate untrusted local users and workloads in sandboxes
Longer-term hardening
- Run untrusted workloads inside sandboxes such as Firecracker or gVisor
- Monitor upstream kernel and distribution security advisories for CVE assignments tied to this disclosure
Affected and fixed versions
- Linux Kernel Organization — Linux kernel
Timeline of Linux kernel LPE pipeline
- locked-ioc-8's Patch the Planet program launched (June 2026; exact day not stated in the source).
- July 2026 run with locked-ioc-6 found 166 unique bugs (exact day not stated in the source).
- 948 unique local privilege escalation bugs were deduplicated and 948 patches were written (approximate; exact date not stated in the source).
- locked-ioc-8 executed the automated pipeline with an upcoming cyber model in October 2026: 2,308 candidate findings in 12 hours, 1,724 reproduced in isolated VMs (exact dates not stated).
- Within 10 days of reporting, 61 bugs were patched upstream, 43 had staged patches and 299 were under public discussion (approximate date; the source gives only the 10-day window).
- Cyber Security News published a summary of the locked-ioc-8 research disclosing the 948 locked-ioc-5 local privilege escalation vulnerabilities.
Sources cited for Linux kernel LPE pipeline
- Linux kernel CVE announcements lore.kernel.org · Advisory
- Google kernelCTF Rules google.github.io · Research
- OpenAI: A thousand fewer paths to root openai.com · Vendor report
- OpenAI Cyber Model Uncovers 948 Linux Kernel Privilege Escalation Vulnerabilities cybersecuritynews.com · News · 2026-11-05
- SecurityWeek: OpenAI agents exploited Linux kernel flaw on company's own systems SecurityWeek · News
Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.
