948 Linux root exploits for $1.2M: OpenAI's agent run shows offensive security now costs as little as cloud compute

Dealroom reports that OpenAI's AI agents generated 948 working exploits that give root access on Linux in a single run, at a cost of $1.2M in API credits. Root access means full administrative control of a machine. The material we have is a single headline, with no detailed source. We can't yet say which kernel versions were involved, whether the flaws were new or already known, or how anyone checked that the exploits work. Those details will decide how much this really matters.

The arithmetic is clear, though. $1.2M divided by 948 exploits is about $1,270 each. Until recently, finding and weaponising a single privilege-escalation flaw could take a skilled specialist weeks. If the figure holds up, finding vulnerabilities has become something you buy by the token, like compute.

**Our read.** This confirms a thesis we have held for months. Saturated benchmarks tell us little. What counts is demonstrated capability on hard tasks with little guidance, and producing real exploits at scale is exactly that. We frame this as a risk to govern, not a ranking of offensive tools. The same capability can work for defenders or attackers. An OpenAI run that finds hundreds of holes is good news if those holes reach maintainers and get patched before someone else finds them. The danger is short term. Once this costs about as much as a server, attackers will get access to it too, and the window between discovery and patch shrinks.

The long-term picture is hopeful. Software audited by agents before every release could be far more secure than anything we have had. Getting there means disclosure and patching have to keep pace with discovery. Until OpenAI or independent researchers publish the details, we treat this as a strong signal still waiting for verification.