OpenAI has described an autonomous pipeline that searched the Linux kernel for security flaws, confirmed them in a controlled test environment, and wrote working exploits and candidate patches for them. In a run in mid-October 2026 using an upcoming cyber model, the pipeline analysed 2,308 candidate findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 working local privilege escalation (LPE) exploits for a commonly used Linux distribution. An LPE flaw lets an unprivileged user on a machine gain root access. The total run cost was $1,213,430 in API credits, or about $1,279 per exploit. The target machines ran a stock desktop operating system rather than a deliberately weakened configuration. OpenAI said human researchers reviewed the outputs and reported the vulnerabilities alongside candidate patches, starting with critical issues in line with Linux kernel community guidance. The company is also working with Patch the Planet partners on further reports. In a separate test on kernelCTF, an adapted kernel with reduced attack surface, the pipeline produced 21 LPE exploits for about $32,936 in API credits. OpenAI estimated that, if accepted, those would be worth around $1.5 million in bounties, though that figure is hypothetical. The company also said that within ten days of the scan running, more than 100 Linux LPEs had been patched or had staging patches from other contributors, with around 300 more publicly discussed. Its newer model found more than five times as many novel LPEs as a GPT-5.6 Sol run in July, despite three months of hardening in between. OpenAI argued that automated patch generation is becoming essential as frontier models find vulnerabilities faster. It also said that, for now, a low-privileged account on an unpatched system should be treated as close to root access for a well-resourced attacker. It recommended sandboxing and isolation tools such as Firecracker and gVisor to limit the damage from exploited flaws. The cyber model used in the work has not yet been released, and the patches remain candidates pending maintainer review. For Australian businesses, this changes little immediately, but it reinforces a basic point: keep Linux servers, workstations and shared systems on current kernels and apply vendor patches quickly, since privilege escalation flaws matter most once an attacker has any foothold. Teams should confirm their patch cadence and limit local accounts on critical hosts. Nothing here creates a new Privacy Act obligation by itself, but if an unpatched host holding personal information were compromised, the Notifiable Data Breaches scheme could apply.