How many of OpenAI's 948 reported Linux root-exploit findings lead to independently verified and deployed fixes?
OpenAI
This is a first-record evidence baseline. It does not establish independent verification of every research result or completion of future commitments.
Claim and evidence
OpenAI reports an October 2026 agent-assisted Linux kernel research campaign that produced 2,308 candidate findings, dynamically reproduced 1,724 faults and identified 948 distinct local privilege-escalation vulnerabilities through exploit and patch analysis, with $1,213,430 in reported API credits. Human researchers were assigned to review and report findings to maintainers. The published company report is evidence for the reported experiment and its methodology, not independent confirmation that all 948 fixes were merged or deployed.
Limitations and uncertainty
The 948 count is deduplicated according to OpenAI's own patch-variant analysis. Candidate patches and working exploits are not proof of upstream acceptance, distribution delivery, exploit uniqueness confirmed by independent maintainers or measured security benefits for users. Company API credits exclude broader operational costs.
Explicit acceptance criteria
- Locate accepted upstream commits and distribution security advisories linked to deduplicated findings.
- Distinguish maintainer-reviewed patches from OpenAI-generated candidate patches.
- Record independent reproduction and patch-regression results where available.
Dated baseline events
The entries below capture original source and publication milestones. They do not imply that later claims have already been fulfilled or independently replicated.