OpenAI Found 948 Ways to Get Root Access in Linux. That’s Progress.

Finding hundreds of ways to break into the software running the world is an uncomfortable kind of good news.

The vulnerabilities were already there. Now someone who can help fix them knows where to look.

That’s how I read OpenAI’s latest Linux security research, and the increasingly enormous security releases coming out of Microsoft. We’re watching powerful AI systems expose weaknesses that software has carried around for years. The resulting patch lists look alarming. But getting those weaknesses found, verified, and fixed is exactly what we should want.

Even if it means waiting a little longer for the next model.

On November 4, OpenAI reported that an upcoming cyber model reproduced 1,724 Linux kernel vulnerabilities and demonstrated 948 distinct local privilege escalation vulnerabilities. Those let someone with limited access gain root, the system’s highest level of control.

The run cost about $1.2 million in API credits. Its workflow combined discovery, exploit validation, candidate patches, and human review. OpenAI says hundreds of reports and patches have been submitted; that doesn’t mean all 948 fixes have reached users.

That distinction matters. Finding a hole, proposing a repair, and protecting someone’s actual computer are separate milestones.

Still, this is a substantial demonstration of what happens when defenders get capable AI tools and put them to work.

And Linux is only part of the story.

Windows’ patch numbers show how broad this has become.

To examine the recent surge, we reviewed Microsoft’s current machine-readable security release notes for the 90-day window from August 7 through November 5, 2026.

Here’s what their Windows product-family summaries report, with July included for context:

The three monthly releases inside that window report 2,059 Windows vulnerability entries addressed. October’s count was roughly 4.6 times August’s.

A little counting housekeeping: these are Microsoft’s Windows summary counts as retrieved on November 5. They count vulnerabilities addressed, not individual patches you download. Cumulative updates can fix many vulnerabilities at once. The sum also isn’t a deduplicated census of every Windows flaw fixed during the period, and it excludes a separate accounting of out-of-band releases. Microsoft revises these records, which helps explain differences from launch-day headlines.

The progression isn’t a straight line—August fell below July—but September and October show a dramatic increase.

Microsoft anticipated this. In July, Windows chief Pavan Davuluri explained that AI-assisted discovery would increase security-update volume. The company described using multiple AI models to scan Windows, with human experts evaluating findings and reviewing fixes.

His explanation was unusually direct: “This is evidence that defenders are getting better at identifying and addressing issues.”

That doesn’t establish that AI found every vulnerability in those releases. It does establish that the connection between AI-assisted discovery and larger patch lists is more than speculation.

The industry is getting a much brighter flashlight. Naturally, we’re seeing more of what was hiding under the furniture.

Give the people fixing the software a head start.

This is also why I support giving security teams early access to highly cyber-capable models.

When a model can find serious weaknesses quickly, letting the organizations responsible for that software use it first creates an opportunity to close those weaknesses before similar capabilities become widely accessible.

There’s precedent beyond OpenAI. At the April launch of Project Glasswing, Anthropic described giving its unreleased Mythos Preview model to technology companies and organizations maintaining critical infrastructure. Some partners had already been using it for several weeks.

We previously covered how that effort exposed bugs humans had missed for decades. The practical objective was straightforward: use the capability to improve defenses while there was still time to gain an advantage.

There isn’t a universal two-week or three-week waiting period. Some programs keep access restricted much longer, and some specialized models may never receive an unrestricted public release. But even a few weeks spent validating findings and shipping fixes can be valuable.

Does waiting for a model stink when you’re excited to use it? Sure.

Would I accept a short delay that lets maintainers repair serious vulnerabilities before a broader release? Absolutely.

That’s a concrete use of the waiting period. The work produces something useful: repaired software that everyone can benefit from, including people who never open an AI chatbot.

OpenAI’s Patch the Planet initiative also recognizes an essential part of this process: maintainers need actionable evidence. Its researchers validate findings, remove duplicates, reassess severity, and develop patches before sending reports upstream.

An exhausted open-source maintainer doesn’t need 10,000 confident messages saying something looks suspicious. They need reproducible findings and repairs they can evaluate.

Every properly closed hole takes an option away from an attacker.

This is the reason I’m optimistic.

Once a sound fix is installed, that particular vulnerability becomes less useful to the next hacker—or the next AI system—looking for a way in.

It might remove one step from a larger attack. It might prevent a compromised account from becoming complete control of a server. Across widely deployed software, those improvements can protect systems far beyond the organization that originally found the flaw.

The protection depends on deployment, of course. A patch sitting in a repository hasn’t secured an outdated machine.

That makes the next bottleneck especially important. Discovery can accelerate faster than organizations can review, test, and deploy the resulting repairs.

Microsoft is already exploring ways to group vulnerabilities around shared risk questions: which components are exposed, where untrusted content enters, and which privilege boundaries need protection. The approach is provisional, but the underlying problem is real. Security teams need to make good decisions across much larger volumes of findings.

Powerful research agents also need strong containment. Our earlier reporting on OpenAI’s agent-security challenges shows why permissions, isolation, monitoring, and intervention have to work together.

Those are engineering problems worth solving. They’re part of turning impressive discoveries into dependable protection.

I’d argue this wave of scrutiny creates an opportunity to make widely used software more thoroughly examined and hardened than ever before.

The evidence doesn’t yet prove that software overall is now the most secure it has ever been. Attackers are gaining capabilities, new code introduces weaknesses, and patch totals alone don’t measure how much risk remains.

But we can see something encouraging happening: defenders are finding weaknesses at a scale that was previously difficult to achieve, and maintainers are getting opportunities to close them.

The next phase of the AI race should reward companies that turn model capability into reliable protection—validated findings, well-tested repairs, and updates that reach real machines.

I’m happy to wait a little longer for a model if that time helps make the software we already depend on harder to break.

Related reading

• AI found bugs humans missed for 27 years — Earlier coverage of Mythos, Project Glasswing, and the effort to repair longstanding software vulnerabilities.
• OpenAI Agent Security: The New Rules for Containing AI Agents — Why increasingly capable security agents require layered controls and reliable intervention.