OpenAI says an experimental, unreleased cybersecurity model identified 948 distinct flaws in the Linux kernel — the core component of the Linux operating system that manages hardware, memory, and other system resources — and developed working attacks against them during controlled security tests. The results, published on November 4 after testing throughout October, were also announced in a post on X.

The flaws could allow someone with limited access to a computer to gain full administrator control, a category of weakness known in security research as privilege escalation. Researchers said the model produced working attacks under normal desktop security settings, and the findings concern software widely used by servers, cloud services, and blockchain networks.

The announcement arrives as crypto companies tighten their own defenses after a series of industry security incidents.

How the Research Worked

The review began with 2,308 possible flaws. Automated tests reproduced 1,724 of them, and further checks identified 948 distinct flaws that allowed users to obtain administrator rights. OpenAI used separate patches to count unique findings.

The system examined selected parts of the Linux code, tested potential weaknesses on isolated computers, and checked whether attackers could actually use them before drafting repairs. Human researchers then reviewed the evidence and proposed fixes, which were reported to Linux maintainers — an approach consistent with coordinated disclosure, the common security practice of sharing findings and proposed fixes with maintainers so patches can be prepared ahead of publication. The model itself remains unreleased, so the reported capabilities reflect OpenAI's controlled testing rather than a publicly available tool.

OpenAI said the process cost $1,213,430 in API credits, an average of $1,279 for each verified flaw paired with a working attack. Comparing that spending with historic security contest awards, in which independent researchers demonstrate exploits for prizes, the company estimated the hypothetical value of the exploits at between $18.9 million and $66.3 million. The company added that it has submitted hundreds of reports and patches for serious problems, and that Linux developers fixed or prepared fixes for numerous flaws during the research.

Crypto Infrastructure Context

Linux supports many blockchain nodes, cryptocurrency exchange servers, and other digital infrastructure, placing kernel security within the industry's operational footprint. The announcement follows a recent Binance security breach, where attackers reportedly targeted employees and reached systems that approve wallet transfers. OpenAI did not connect its Linux research to that incident or identify any affected crypto operator.

Separately from the research, Solana wallet provider Solflare restricted access to its code and infrastructure after recent industry attacks. The wallet provider described the measures as a "bunker mode," with controls requiring multiple approvals for software changes.

Polygon Labs technology chief Mudit Gupta told CoinDesk that decentralized blockchain networks have multiple operators and backup systems. Those features can reduce dependence on any single machine, although individual services and users may still face security risks.

Crypto teams have also issued unrelated fixes. Ethereum clients Teku and Besu released security updates in late October over certificate concerns affecting certain connections. Those updates address separate weaknesses and do not stem from OpenAI's Linux findings.

Originally reported by CoinCentral.