# OpenAI Cyber Model Uncovers 948 Linux Kernel Local Privilege Escalation Vulnerabilities

> OpenAI reported that an automated, multi-agent research pipeline built on an upcoming cyber model found 948 unique Linux kernel local privilege escalation bugs that let a normal local user gain root. Proof-of-concept code was built and reproduced in isolated VMs, and upstream patching began within 10 days; no CVE IDs, CVSS scores or in-the-wild exploitation are reported in the source.

- **Published:** 2026-11-05T02:58:23Z
- **Last reviewed:** 2026-11-05T02:58:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5289
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5289.png
- **ID:** TL-2026-5289
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

Cyber Security News (2026-11-05) summarizes OpenAI research describing an October 2026 run of an automated vulnerability-research pipeline using an upcoming, unnamed OpenAI cyber model. Scout agents identified 5,034 audit targets covering about 2.8 million lines of kernel code (roughly 7% of the kernel). Analyst agents produced 2,308 candidate findings in 12 hours. Triage agents then built proof-of-concept code and tested it in isolated virtual machines with Kernel Address Sanitizer; 1,724 findings (74.7%) reproduced. About 3.1% of findings were false positives caused by impossible conditions. Variant analysis deduplicated the results down to 948 unique local privilege escalation bugs, and human review verified results before reporting.

Exploit agents generated 291 information-leak proofs and 1,169 working privilege escalation exploits, and tested them against SMEP, SMAP, KASLR and HARDENED_USERCOPY. On a hardened kernelCTF-style setup the pipeline produced 21 privilege escalation exploits at a cost of $32,936. Total API cost was reported as $1,213,430 (about $1,279 per exploit), with an estimated value of $18.9 million to $66.3 million when compared with public bounty programs (Pwn2Own at $20,000, TyphoonPWN at $70,000, kernelCTF at $71,337 per eligible exploit). A prior July run with GPT-5.6 Sol found 166 unique bugs.

Remediation progress: 948 patches were written. Within 10 days, 61 bugs were patched upstream, 43 had staged patches and 299 were under public discussion. The source article gives no CVE identifiers, no CVSS data and no affected kernel version ranges. It does not report in-the-wild exploitation. The severity of HIGH is an analyst estimate for local-to-root privilege escalation with reproduced PoCs. The article's defensive takeaway is that a low-privileged account on an unpatched system should be treated like root access for a well-funded threat actor. Recommended mitigations are prompt kernel updates followed by a reboot, limiting unprivileged user namespaces, and sandboxing with Firecracker or gVisor. The article ties the work to OpenAI's Patch the Planet (launched June 2026) and Daybreak programs and to the blog post 'A thousand fewer paths to root'. The OpenAI primary posts could not be retrieved (HTTP 403), so figures here rely on the secondary article and the Google kernelCTF rules page.

## MITRE ATT&CK

- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Linux Kernel LPE (TL-2026-5289) - Root Process Spawned by Non-Root Parent Outside Privilege Brokers** (`TL-2026-5289-SPL-001`)

Detects the core behaviour of the 948 Linux kernel local privilege escalation bugs in TL-2026-5289: an unprivileged process gaining uid 0 and spawning a root child without going through sudo, su, pkexec, sshd or another setuid broker. A kernel LPE exploit (commit_creds style) leaves a root shell or helper whose parent still runs as the low-privileged account. A low-privileged valid account on an unpatched Linux kernel host should be treated as root-equivalent, so this is the highest-value hunt for the disclosure. No CVEs are published, so detection is behavioural rather than signature based.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1078
- **Data sources:** sysmon_for_linux, linux_process_creation, microsoft_defender_for_endpoint_linux
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 User=root ParentUser=* NOT ParentUser=root NOT ParentImage IN ("/usr/bin/sudo","/usr/bin/su","/bin/su","/usr/bin/pkexec","/usr/sbin/sshd","/usr/bin/passwd","/usr/bin/newgrp","/usr/bin/crontab","/usr/sbin/cron","/usr/lib/polkit-1/polkit-agent-helper-1")
| eval threat_id="TL-2026-5289"
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as root_children values(CommandLine) as cmdlines by threat_id host ParentUser ParentImage
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where AccountName == "root"
| where isnotempty(InitiatingProcessAccountName) and InitiatingProcessAccountName != "root"
| where InitiatingProcessFileName !in~ ("sudo", "su", "pkexec", "sshd", "passwd", "newgrp", "crontab", "cron", "login", "polkit-agent-helper-1")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Root Process Spawned by Binary in User-Writable Path - Linux Kernel LPE
id: 3b7e1c4a-6d52-4f0e-8a19-c2d5e7f10a01
status: experimental
description: Detects a root process whose parent executable lives in a user-writable directory (/tmp, /dev/shm, /var/tmp, /home, /run/user). This is the typical shape of a local kernel privilege escalation exploit (TL-2026-5289) that gains uid 0 and spawns a root shell or helper.
references:
    - https://cybersecuritynews.com/openai-uncovers-948-linux-kernel-vulnerabilities/
    - https://google.github.io/security-research/kernelctf/rules.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.t1068
    - attack.t1078
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        User: 'root'
        ParentImage|startswith:
            - '/tmp/'
            - '/dev/shm/'
            - '/var/tmp/'
            - '/home/'
            - '/run/user/'
    condition: selection
falsepositives:
    - Administrators running self-built tools from a home directory after switching to root
    - Software installers executed from /tmp as root
level: high

```

**Known false positives:**

- Legitimate setuid helpers or login/session managers not in the exclusion list that start root children from a user context
- Administrators using custom privilege wrappers (doas, sudo-rs, ksu) that Sysmon records with a non-root ParentUser

**Tuning notes:** Add site-specific privilege brokers (doas, ksu, sudo-rs, container runtimes) to the ParentImage exclusion list after a 7-day baseline. The Sigma variant is a narrower high-fidelity form that only fires when the parent runs from a user-writable path; Sigma cannot compare ParentUser to User. Confirm that your Sysmon for Linux build emits ParentUser; if not, switch to auditd SYSCALL records correlated by ppid.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Exploit Compiled in Temp Directory Followed by Root Process - TL-2026-5289 Kernel LPE Staging (locked: unlock with TL Creds)
- Public Exploit / PoC Download via curl, wget or git on Linux Host - TL-2026-5289 (locked: unlock with TL Creds)
- Unprivileged User Namespace Creation via unshare by Non-Root User - TL-2026-5289 (locked: unlock with TL Creds)
- Root Process Spawned from User-Writable Path Parent - Kernel LPE Exploit Execution (TL-2026-5289) (locked: unlock with TL Creds)
- Setuid Bit Set on Shell or Temp-Path Binary - Post-Exploitation Root Persistence (TL-2026-5289) (locked: unlock with TL Creds)
- Container or Sandbox Escape to Host Namespaces After Kernel LPE (nsenter / Privileged Container) - TL-2026-5289 (locked: unlock with TL Creds)
- Kernel Pointer Leak Reconnaissance by Unprivileged User (KASLR Defeat) - TL-2026-5289 (locked: unlock with TL Creds)
- Kernel Oops / KASAN / Panic on Production Host - Failed Kernel Exploit Attempt (TL-2026-5289) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [OpenAI Cyber Model Uncovers 948 Linux Kernel Privilege Escalation Vulnerabilities](https://cybersecuritynews.com/openai-uncovers-948-linux-kernel-vulnerabilities/)
- [Google kernelCTF Rules](https://google.github.io/security-research/kernelctf/rules.html)
- [OpenAI: A thousand fewer paths to root](https://openai.com/index/a-thousand-fewer-paths-to-root/)
- [SecurityWeek: OpenAI agents exploited Linux kernel flaw on company's own systems](https://securityweek.com/openai-agents-exploited-linux-kernel-flaw-on-companys-own-systems)
- [Linux kernel CVE announcements](https://lore.kernel.org/linux-cve-announce/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5289