Vulnerability Discovery Became Manufacturing : 948 Root Exploits for $1.2M

Two documents landed hours apart, either side of midnight UTC on 4 and 5 November, reading them side by side is revealing . One is a vendor post about 948 working Linux root exploits. The other is an economics study of what happens to a software market when a frontier model is handed to the largest firms on earth.

Read together, they answer a question the coverage has been asking badly: Is AI making attackers stronger? The answer is tha the supply of flaws industrialized, and their use in the wild did not follow.. Here is what each document says, what it costs to be wrong, and where to check it yourself.

1. OpenAI industrialized Linux root

Late on 4 November UTC, OpenAI published "A Thousand Fewer Paths to Root", a five-stage autonomous pipeline running an unreleased cyber model against the Linux kernel. The costed steps, in the order they ran:

OpenAI puts the run at $1,279 per working exploit. The target virtual machines ran a stock desktop operating system rather than a weakened one. Only 3.1% of the findings reflected incorrect model analysis, where the reported vulnerability assumed an impossible condition; most of the remainder either required elevated privileges or failed to reproduce inside the time budget, because of race conditions, trigger conditions such as a required allocation failure at a specific line, or slow validation like refcount wraparound (OpenAI, 4 Nov 2026).

The 1,169 working exploits reduce to 948 unique vulnerabilities after variant analysis. That is the number OpenAI uses as the total, and the reason the patch count is also 948.

Two comparisons do the real work.

Against the market. On an adapted kernelCTF environment, a build of the kernel with reduced attack surface, the same pipeline obtained 25 information-leak proofs of concept and 21 LPE exploits for $32,936 in API credits. Twenty-six confirmed 0-day LPEs have been accepted by kernelCTF in 2026 to date. Had those 21 been accepted, OpenAI estimates roughly $1.5M in bounties, about 45 times the scanning cost.

Against its own previous run. OpenAI says the agents used at least 10 novel Linux exploitation techniques. The pipeline found more than five times as many novel LPEs as a GPT-5.6 Sol run in July, despite three months of hardening between the scans .

OpenAI frames this as defense, and the framing is not dishonest: it reported the findings and generated candidate patches for maintainer review, and notes that within 10 days while the scan was running, over 100 Linux LPEs had been patched or had staging patches from other contributors, with roughly 300 more under public discussion (OpenAI, 4 Nov 2026).

The arithmetic is indifferent to intent. Applying the historical contest bounties ($20,000 at Pwn2Own, $70,000 at TyphoonPWN) to the 948 exploits produces a hypothetical $18.9M to $66.3M valuation, 16 to 55 times the API spend. That is the same sum an attacker runs.

2. The paper that changes the frame

Hours later, in arXiv's 5 November batch, Thomas Mosk of Queen Mary University of London published "Does Frontier AI Strengthen Cyber Defense? Evidence from Project Glasswing". It studies Anthropic's April 2026 program, which gave 13 large US firms early access to Claude Mythos Preview, a model for finding software vulnerabilities.

The treated firms were AWS, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks and IBM. Mosk compared them against Chinese and Russian firms excluded by Anthropic's terms, using the universe of public vulnerability disclosures (Mosk, 5 Nov 2026).

Read the last two rows together, because they are easy to misread. The share of vulnerabilities exploited within a month of disclosure fell by about two-thirds, but the number exploited did not change. The denominator grew fast enough to pull the rate down. That is what abundance looks like in the data, and it is not the same thing as safety.

The consequence for this year's bounty market sits in the middle rows, and Mosk states it plainly:

"As treated firms found more flaws themselves, external researchers, who sell their findings through bug bounties, reported about half as many vulnerabilities in treated firms' code and more in other firms' code, without leaving the market." (Mosk, 5 Nov 2026)

The outside researchers did not quit the market. They reported more against firms outside the program. That is a different event from the AI-slop flood that led GitHub, Apple and Google to cap or pause external intake this year, and it points the other way.

Two more figures establish scale. Anthropic said on 7 October that Glasswing found at least 129,000 verified vulnerabilities between April and July 2026, more than 33,000 of them critical or high severity, and that this is "likely an undercount" whose true impact is "at least five times higher" (The Hacker News, 7 Oct 2026).

And Mosk names the distributional consequence without hedging: restricted release "creates an asymmetry in software security between firms in different countries" (Mosk, 5 Nov 2026).

Which makes the OpenAI post the opposite of a lab stunt. It is a scale-up: from the 24 Linux exploits GPT-5.5 Cyber produced in June to 948 in October, in a market where zero-day supply is industrializing and where access to the production line is allocated by firm and by passport (OpenAI, 4 Nov 2026).

3. The correction that reframes both

The instinct on seeing 948 exploits is to assume 948 new ways to break into servers. The exploitation data says otherwise, and has said so since July.

VulnCheck analyzed 1,061 publicly attributed AI-assisted discoveries from Project Glasswing and the Berkeley Vulnerability Research Initiative, then cross-referenced them against its Known Exploited Vulnerability database. Fourteen, or 1.3%, had been confirmed exploited in the wild, "almost identical to the rate across all vulnerabilities in VulnCheck's dataset" (The Register, 28 Jul 2026). An analysis published in late September put the figure at 2 of 300, or 0.67% (The Hacker News, 7 Oct 2026).

The two figures do not contradict each other, and they should not be averaged. They come from the same researcher months apart, on different denominators and partly different populations: the 1,061 set includes the Berkeley Vulnerability Research Initiative, the 300 set does not. Both are secondhand retellings of reports I have not read in their original form.

Two sources add three datapoints about where the pressure now sits. Veracode found roughly 44% of AI code-generation tasks introduced a risky vulnerability in tests, with average security pass rates stuck at 56%, barely changed from 55% (The Hacker News, 7 Oct 2026). Terra Security reviewed every published CVE record and GitHub-reviewed advisory, and found the share of GitHub security fixes needing a follow-up failed-patch advisory within 90 days went from about 0.2% across 2019–2025 to 2.3% in 2026. In the Linux kernel, 3.2% of CVEs were introduced by the fix for another CVE, rising to about 10% in busy subsystems like fs/smb and net/sched (The Register, 19 Oct 2026).

Put those together and the conclusion is not that exploits are coming. Discovery, validation, patch generation and patch review all got cheap or automatic at the same moment. Nothing in these datasets measures whether the human capacity to adjudicate grew with them, and no vendor publishes a number that would settle it.

OpenAI concedes the shape of the problem in its own text. The discovery stage "produced thousands of candidate findings, too many for security researchers to manually review and triage", and "the operational challenge of our vulnerability discovery pipeline was not discovery, but determining which findings could be reproduced, what security boundary they crossed, and which warranted the earliest maintainer attention" (OpenAI, 4 Nov 2026).

The scarce resource moved from finding the bug to deciding which of 2,308 reports matter. That is a staffing and process problem, and neither document offers a fix for it.

4. What this doesn't establish, and what it costs to be wrong

Four limitations worth holding onto before we do repeat any of the above.

The Glasswing sample was not random. Mosk says so directly: "Selection into Project Glasswing was not random" (Mosk, 5 Nov 2026). The 13 firms are among the largest and best-resourced software producers on earth. Their external bug reports could have halved because of model access, or because firms of that size naturally see fewer outside findings over time. A single-author preprint on 13 chosen firms cannot fully separate those.

The two exploitation-rate figures come from one organisation, VulnCheck, in two separate analyses two months apart. I have not seen either in original form; both reach this article through press retellings. Their denominators differ by a factor of three and a half — 300 against 1,061 — and the populations behind them are not the same set. Neither is the 129,000 vulnerabilities Glasswing reported. Treat the range as 0.67% to 1.3%, and treat the larger sample as the stronger reading.

One side of this is vendor self-report. OpenAI is describing its own prototype, on its own target configuration, with its own cost accounting. It notes that the costs are "an upper bound" and that harness engineering could cut them (OpenAI, 4 Nov 2026). No independent party has published a run of the pipeline.

One sample is not a trend. Yes, five times more novel LPEs than July is striking. It is also one comparison across one codebase, and the kernel was hardening at the same time, which cuts both ways: it makes the increase more impressive and makes the baseline less clean.

What that uncertainty costs depends on which part fails.

If the exploitation reading is wrong, and the glut of AI-found vulnerabilities does turn into attacks at a materially higher rate than 1.3%, then the cost lands on anyone who treated this week as a reason to slow down. Patches are cheap. A missed one is not.

If the Glasswing halving is really a firm-size effect and not a consequence of model access, a bounty-program owner who redesigns intake around "the researchers left" has reorganized for the wrong cause. That is the likelier of the two errors, because selection is the problem the paper cannot solve.

And if the country asymmetry gets read up from a single-author preprint into settled policy fact, someone will spend money against a number that has not been through review. The paper measures the asymmetry. It does not establish its size or its durability.

5. Where to check it yourself

Sections 1 and 2 rest on public documents: the OpenAI post and arXiv 2611.06629. Both can be read in an hour and neither requires trusting me.

Section 3 is a thinner layer. Its figures arrive through The Register's write-up of the VulnCheck analysis, The Hacker News' report on Anthropic's expansion and The Register's write-up of Terra's CVE review. Those links go to the reporting, not to the underlying reports, because VulnCheck's research was shared directly with The Register rather than published in full.

So sections 1 and 2 you can verify. Section 3 you can trace but not fully verify, and it is the part most worth arguing with.

6. What to watch next

• Kernel maintainer load. OpenAI generated 948 candidate patches, and observed roughly 300 more Linux LPEs under public discussion while its scan was running (OpenAI, 4 Nov 2026). Terra's 3.2% fix-introduces-CVE rate is what a flood of fast fixes produces.
• Whether press makes the abundance distinction. If coverage stays at "AI will own your server," the useful half of this week is being missed, and the staffing problem stays invisible.
• Bug bounty pricing. Watch whether payouts plateau as supply is partly internalized by the vendors that got early access, and whether researchers keep migrating to firms outside the program.
• The next AI-assisted discovery that isn't Linux. Linux was the demonstration case because it is huge, important, and a stock kernel can be instrumented with KASAN to catch memory corruption. OpenAI points at browsers, image-parsing libraries and the TCP/IP stack as the core software that most needs the same treatment .
• MCP and agent supply chains. Three preprints in this same period work that layer. Signed, Sealed, Leaked demonstrates a legitimately signed MCP tool that does its advertised job while leaking data to an allowed destination; Meta's MCPGuard-Dynamic failed to block it in every trial, and the authors' germline-execution fix showed no unauthorized disclosure across 153 attack runs. AgentTrustCI turns policy, grounding and trajectory expectations into build-time tests on recorded traces. SecureGARD reports a 0% attack success rate across three agent benchmarks using ontology-guided governance. The line worth keeping is the first paper's: a signature "proves only who published the exact bytes, not what the bytes do once they run."
• Whether anyone measures the thing that broke. None of the vendors above publishes a valid-report rate. Until one does, the claim that bounty programs are receiving half as many external findings will stay an inference from a single preprint.