{
  "schemaVersion": "2.0",
  "id": "CL-0011",
  "version": 1,
  "recordUrl": "https://cortist.com/reality-ledger/cl-0011/",
  "snapshotUrl": "https://cortist.com/data/reality-ledger/records/cl-0011-v1.json",
  "sourceDate": "2026-11-04",
  "snapshotDate": "2026-11-05",
  "topic": "AI Cybersecurity",
  "state": "pending",
  "status": "Maintainer-accepted fixes not independently counted",
  "organization": "OpenAI",
  "claim": "How many of OpenAI's 948 reported Linux root-exploit findings lead to independently verified and deployed fixes?",
  "evidence": "OpenAI reports an October 2026 agent-assisted Linux kernel research campaign that produced 2,308 candidate findings, dynamically reproduced 1,724 faults and identified 948 distinct local privilege-escalation vulnerabilities through exploit and patch analysis, with $1,213,430 in reported API credits. Human researchers were assigned to review and report findings to maintainers. The published company report is evidence for the reported experiment and its methodology, not independent confirmation that all 948 fixes were merged or deployed.",
  "limitations": "The 948 count is deduplicated according to OpenAI's own patch-variant analysis. Candidate patches and working exploits are not proof of upstream acceptance, distribution delivery, exploit uniqueness confirmed by independent maintainers or measured security benefits for users. Company API credits exclude broader operational costs.",
  "nextEvidence": "Dated, deduplicated references to upstream Linux commits, advisories, maintainer acknowledgments, downstream distribution releases and independent reproduction of a disclosed sample; track accepted versus still pending fixes.",
  "sources": [
    {
      "name": "OpenAI: A thousand fewer paths to root (original security report)",
      "url": "https://openai.com/index/a-thousand-fewer-paths-to-root/",
      "published": "2026-11-04"
    }
  ],
  "timeline": [
    "2026-10 (mid-month) | Controlled security campaign | OpenAI reports finding, reproducing and assessing Linux kernel vulnerabilities.",
    "2026-11-04 | Company report published | 948 distinct local privilege-escalation vulnerabilities reported; merged fix count not independently audited."
  ],
  "newsUrl": "https://cortist.com/news/openai-linux-kernel-948-lpe-agent-pipeline-2026/",
  "topicUrl": "https://cortist.com/ai-cybersecurity/",
  "kind": "research_replication",
  "deadline": null,
  "verificationCriteria": [
    "Locate accepted upstream commits and distribution security advisories linked to deduplicated findings.",
    "Distinguish maintainer-reviewed patches from OpenAI-generated candidate patches.",
    "Record independent reproduction and patch-regression results where available."
  ],
  "sourceReviewNote": "Cortist read the cited original publication before opening the case; this is not independent replication or resolved-outcome verification",
  "independentlyResolved": false,
  "baselineStatusAsOf": "2026-11-05"
}