Unreleased Claude model builds remote root exploit for Linux kernel bug in 53 minutes

Anthropic has shown that one of its new AI models can turn a serious security flaw in Linux into a working attack in a short time. Linux is the operating system that runs most of the servers on the internet. The company used an internal Claude research model that is not yet public. After an initial prompt from the researchers, the model wrote the attack code itself, Anthropic reported on 27 October.

The flaw is numbered CVE-2026-98432 and sits in the kernel, the core of Linux, which handles network traffic among other things. A mistake in how the kernel clears memory makes it possible to take full control of a server remotely, without a password. This worked on servers that use a certain network technology called Multipath TCP (MPTCP), which lets one connection use several network paths at the same time, for example wifi and 4G.

How the attack worked

The attack has two steps. In the first step, the code tricks the server into giving away a secret address in its memory. Linux hides such addresses on purpose to make attacks harder. This took the model 48 minutes. After that, it took about five more minutes to make the server run a command of its own with the highest level of access. The flaw lies in a brief moment when two processes reach the same piece of memory at the same time. If an attempt fails, only that one connection fails and the server does not crash. An attacker can therefore keep trying.

The flaw has been in Linux since October 2015 and went unnoticed for more than eleven years. It affects network traffic over IPv4, not IPv6.

How serious is it?

Experts disagree on this. The Linux kernel security team gives the flaw a 9.8 on a scale up to 10. In a statement, Red Hat calls it moderately serious (5.9), because it is hard to get the timing right, but its own security database lists an 8.1. Oracle and SUSE also give an 8.1, and Amazon gives a 7.0. With this demonstration, Anthropic shows that under the right conditions the flaw can do more than make a server freeze.

The role of MPTCP comes from Anthropic's explanation. It has not been publicly shown whether a takeover also works on servers without MPTCP, but the security team of the Go programming language takes that possibility into account. This matters because, since version 1.24, Go switches MPTCP on by default for servers on Linux. Some services therefore use it without their administrators knowing.

Updates are on the way

Xinyang Ge of Anthropic reported the flaw, and the makers of the Linux kernel fixed it in early October, including in the older versions that are still maintained. It takes some time for that fix to reach all users. Debian has already released updated versions, and Oracle Linux, Amazon Linux and SUSE have updated some of theirs. For Ubuntu and Red Hat Enterprise Linux, the updates were still being prepared on 30 October. CIQ, the company behind Rocky Linux, gave administrators temporary firewall rules to protect themselves. According to CIQ, switching off MPTCP alone is not enough.

No attacks that exploit the flaw are known. Anthropic has not released the attack code. The company gives software makers 90 days to fix a flaw before it says more about it.

What does this mean for the road to the singularity?

Building an attack on such a difficult kernel flaw used to be work for a small group of specialists, and it often took days or weeks. An AI model has now done it in less than an hour. This shows how quickly AI models are getting better at complex technical work. The good news is that this time the defenders were first: the flaw was found, reported and fixed before anyone exploited it. The lesson for administrators is that installing updates quickly is becoming more and more important. If AI speeds up the finding of flaws, AI can also help to fix them faster.

What is the technological singularity? Read the explanation →