OpenAI's AI Just Found 948 Ways to Get Root on Linux — and It Cost Less Than a Bug Bounty

Originally published at ConvertElementor.

OpenAI's Aardvark agent was given a simple brief: test how much of the Linux kernel an AI can actually secure. It ran for 10 days, at a cost of $88, and found 948 real security issues — 33 of them already confirmed by the Kernel Security team as genuine, valid reports.

Aardvark was built by OpenAI's KernelBench team to autonomously find Linux kernel vulnerabilities and build proofs of concept for them. It got a big production-grade slice of Linux — 1,067 drivers and core modules, fully wired into KVM virtual machines with real I/O, dedicated per-model memory and rate limiting. In total, it looked at 291 million lines and ran them in 2,135 virtual machines.

What it found

• 948 security issues flagged across its corpus, with positive-looking signals in 7,847 individual test cases.
• 33 reports are already confirmed as genuine by the Linux Kernel Security team. A further 323 were already disclosed upstream.
• 175 PoCs already patched upstream — 128 in code and 47 in tests.
• The agent found 40 percent of the issues in the kernel's traditional ripgrep-and-CIL-combination coverage, with 64 issues found by AI guidance that regular tooling did not spot.
• The vulnerability types are practical, not theoretical: high-priority bugs in security subsystems, privilege-escalation paths, unsafe assignments in drivers and uninitialized variables.

The cost comparison

The main model refused hours of in-depth testing. Where its older peers would charge $6,000 for a similar workload, Aardvark spent just $88 — far below what a human tester would normally charge for a single critical vulnerability, let alone a full review.

Linux kernel developers are already taking notice. The kernel appears to be actively looking at both the 948 flagged issues and the quality of Aardvark's proof-of-concept work. In an acknowledgement, OpenAI says that "the kernel has also provided a 12,000-line chunk of code to test with us." The first real test will be whether this actually helps fix kernel bugs before they break things.

Why this matters for WordPress and web developers

Linux runs most of the web — including the servers that host WordPress sites. A cheaper, faster way to find kernel vulnerabilities means faster patches for the infrastructure our sites depend on. It also shows how AI security testing is moving from demos to production-scale work.

Read the full article on ConvertElementor: https://convertelementor.com/blog/openai-s-ai-just-found-948-ways-to-get-root-on-linux-and-it-cost-less-than-a-bug-bounty-november-2026-20261106