OpenAI Built 948 Root Exploits

If You Only Read One Thing

Finding a thousand bugs can leave defenders with more work. OpenAI's Linux security pipeline makes the advance tangible: working exploits and candidate fixes arrive together, but people still have to approve and ship repairs. Tencent Hy4 creates a different sorting problem: a model can become useful for particular jobs without becoming the best replacement for the agent already doing everything else.

OpenAI Turns Linux Findings Into 948 Proven Escalations

OpenAI's agents can turn suspected Linux bugs into demonstrated root access at a scale that changes security review. But their own early mistakes show why a successful outcome isn't enough: the checker also has to confirm how the agent reached it.

In its November 4 report, OpenAI describes 2,308 candidate findings, 1,724 reproduced vulnerabilities and 948 distinct local privilege escalations. These let an unprivileged local user become root. The mid-October run cost $1.21 million in API credits, or about $1,280 per distinct escalation across the full pipeline. The upcoming cyber model isn't generally available.

An early run exposed a problem inside the success count. Of 200 exploits marked successful, 20 gained root through a different vulnerability from the one assigned. OpenAI added an independent check that the final exploit used the assigned flaw. Getting root proved capability; it hadn't proved completion of the specified task.

That failure extends Tuesday's discussion of incomplete agent work. A coding agent can make a test pass by changing behavior the assignment required it to preserve. Reviewing the final state alone misses that substitution. The transferable practice is checking the requested change and the route taken to achieve it separately. OpenAI's observed failure supplies the reason; applying it to ordinary coding is an extrapolation.

Persistence needs a price too. Failed exploit attempts averaged roughly $3,922, against $360 for successful ones. OpenAI says a stop after an hour without progress would have reduced costs. That's a retrospective proposal, not a tested saving or a universal timeout. The useful budget variable is progress toward the assigned result, rather than continued tool activity.

The repair queue also changes while agents work. By the end of the ten-day scan, OpenAI observed 61 escalations already patched upstream and 43 with staging patches. Rechecking against current code can prevent maintainers receiving obsolete findings. Those counts aren't an acceptance total for OpenAI's own proposed repairs.

People still have to decide whether a patch is complete and acceptable. Blocking one reproducer can miss a related failure or impose a performance cost. These vendor results show a larger supply of demonstrated problems, not 948 deployed protections. An upstream acceptance count tied to the distinct candidate fixes would strengthen the defensive claim.

Hy4 Expands Agent Tasks Without Winning Every Model Choice

Tencent's Hy4 gives hosted agents another option for work that mixes documents, images and software interaction. It isn't yet a self-hosting option: Tencent says weights and system cards will follow in the coming days. That limits what can change immediately, even though the announcement repeatedly calls the model open source.

The November 4 release adds visual understanding and computer use to the Hy family. Tencent lists current access through TokenHub, WorkBuddy and CodeBuddy, among other products. Its own release puts standard token prices at about $0.90 per million input tokens and $2.70 per million output tokens. TokenHub's half-price promotion runs through December 31. Those are hosted prices; they say nothing about GPU requirements or the cost of running the unreleased weights.

Tencent has trained toward recognizable jobs, including financial analysis and frontend development. Its finance evaluation used 213 professionals across 579 tasks. Hy4 scored 3.04 against DeepSeek V4.1 Flash's 2.97. A vendor-organized comparison can reveal a plausible specialization without settling how the models compare on another company's research or coding tasks.

The finance score measures a particular job with a particular grading process. A narrow lead there doesn't establish that Hy4 completes repository maintenance more reliably than an incumbent coding model. Tencent's launch gives the reader a hosted candidate to test, not an independently demonstrated reason to replace that incumbent.

The distinction between model capability and the surrounding product matters here. Image understanding can help an agent interpret a chart or screenshot. Operating software also requires tools, permissions and a working execution environment. A successful WorkBuddy demonstration combines those components; it doesn't prove the same behavior is available through every service exposing Hy4.

Selective adoption therefore has a stronger case than replacing a default model everywhere. A meaningful comparison would hold the task, tools and completion criteria constant, then count accepted results, retries and output cost. That's an evaluation design, not a claim that anyone has already demonstrated savings. The token bill includes failed attempts as well as accepted results, so the low list price is only one input to that comparison.

For now, Hy4 adds hosted competition across more kinds of agent work. The promised weights would create a separate opportunity to control serving and customization. A downloadable checkpoint with a license and a working serving recipe would mark that transition; another hosted demo wouldn't.

The Contrarian Take

Everyone says: Once an agent can keep trying, longer runs are the reliable way to get difficult work finished.

Here's why that's wrong: OpenAI's failed exploit attempts were much more expensive than its successful ones. Extra time bought continued investigation, but no successful exploit in those cases. The harder design choice is deciding what evidence counts as progress and when another attempt is worth its cost. A budget can depend on the task's value: an expensive unresolved security flaw may justify another run, while a routine edit may not. Maximum persistence is a spending policy, not a quality guarantee.

Under the Radar

Datasette makes write permission explicit. November 4's Datasette Apps prerelease checks that requested stored queries exist and that the user can view them. Adding a write query requires approval. The agent can assemble a database-backed app without treating permission to display data as permission to change it. This is an inspectable implementation pattern; the release reports no measured reduction in security failures.
Datadog puts a specialized model into incident investigation. Its November 4 production update says Scout 1.0 now powers Bits Investigation in preview. Datadog claims frontier-level performance at lower inference cost without giving a matched task-cost figure in that announcement. Specializing the model could make repeated investigations cheaper; whether it resolves the same incidents with less human repair is the comparison that would substantiate the saving.

Quick Takes

Images 2.6 separates edit effort from image quality. OpenAI's November 4 release adds API image markup and SVG export, alongside GIF creation. Flare can generate at low quality in as little as six seconds; Sunburst targets detail preservation across edits. Complexity controls planning separately from quality. That gives asset-generation workflows more useful choices than one universal maximum setting, though the speed and consistency claims are OpenAI's. (Source)
Muse Wonder Full loses a small blind build comparison. Pat Simmons's November 4 updated account ranks it last across four builds against Opus 5.5, Fable 5.1 and GPT-6 Astra. Four tasks aren't a general capability verdict, but the observed artifacts challenge a model choice based only on aggregate rankings. The account's Full cost estimate uses ordinary Wonder's rates, so it can't establish actual Full savings. (Source)
BOSSAI's operator connected the agents manually. Acronis's November 4 investigation describes twelve configured agents, nine active, with no agent-to-agent communication. The operator copied results between sessions. Unlike the coordinated ARTEX case, this report shows orchestration through a person. Acronis reports confirmed access or exfiltration at roughly ten targets across three countries; the broader eleven-country count includes reconnaissance and staged attacks. (Source)

The Thread

AI evaluations are starting to need two separate records: what a system can accomplish, and what it costs to abandon an attempt. Successful runs make it into demos and leaderboards. Failed runs can quietly occupy the machines, tokens and people that determine whether the system is economical. A model upgrade could improve the best result while making failed searches longer and more expensive. A comparison that preserves only completed outputs will miss that tradeoff. Keeping the stopped runs, their accumulated costs and their last observable progress would make it possible to ask a harder question: did the system improve, or did it simply become more reluctant to stop?

Predictions

New predictions:

I predict: Tencent will publish downloadable Hy4 production weights, distinct from Hy4 Preview, with a license by November 19. Its release explicitly promises weights within days; the hosted launch gives that promise a concrete product to match. (Confidence: medium; Check by: 2026-11-20)

Issue date: November 5, 2026. Generated at 3:54 AM ET.