The story behind the cartoon
OpenAI published “A thousand fewer paths to root” on November 4, describing an autonomous security pipeline that sifted 2,308 candidate findings in the Linux kernel, reproduced 1,724 of them as real vulnerabilities, and distilled those into 948 distinct working local privilege-escalation exploits.
Every one of the 948 came with a generated candidate patch, and the whole run cost $1,213,430 in API credits, about $1,279 per exploit. OpenAI says it is working with kernel maintainers and its Patch the Planet partners to push the findings toward real fixes, with human review before anything is reported.
The exploits need a low-privileged local account and were tested on a stock desktop Linux configuration with standard protections switched on. The patches are candidates for maintainer review, not merged fixes — the count describes validated exploits with drafted patches, not fixes already shipped.
The joke is the locksmith who picks every lock: one cheerful little robot, keys jangling, standing at the fortress door marked ROOT — the burglar and the repairman are the same machine.
