On November 4 local time, OpenAI officially released a highly anticipated security research report. The report revealed that OpenAI used an upcoming new cybersecurity model to successfully build a complete closed-loop process covering automated vulnerability discovery, validation, exploitation, and remediation, delivering an impressive scorecard in real-world testing.
Striking test data: dynamic reproduction and exploitation among thousands of candidate vulnerabilities
In a real-world test conducted in October 2026, the system demonstrated extremely powerful automated security attack-and-defense capabilities. From a massive pool of 2,308 candidate vulnerabilities, the system successfully dynamically reproduced 1,724 of them and ultimately generated 948 Linux kernel privilege-escalation exploits that could allow an ordinary local user to obtain the highest system privileges.
In terms of economic cost and efficiency, the entire automated testing process consumed about $1.21 million in API credits. On average, the cost of generating each exploit was only about $1,279, demonstrating extremely high potential for industrial-grade applications.
Closed-loop handling from vulnerability discovery to remediation patches
In addition to high-risk privilege-escalation vulnerabilities, the system also performed impressively in other dimensions of security defense. The report noted that the system also successfully generated 291 proof-of-concept (PoC) programs for information-disclosure vulnerabilities.
Even more noteworthy is that the automated system is not only responsible for “breaking,” but also actively participates in “building”—it can automatically generate candidate remediation patches for every vulnerability it discovers and hand them over to human security researchers for final review. Currently, in line with the official recommendations of the Linux kernel community, OpenAI has prioritized submitting hundreds of detailed reports and corresponding remediation patches for severe vulnerabilities to the community, contributing significant strength to the security foundation of open-source operating systems.
