Claude-Generated Linux Exploit Highlights Unpatched Ubuntu Vulnerability

Preface

Anthropic says its AI model Claude generated a working exploit for a serious Linux vulnerability, demonstrating how an internet-connected attacker could potentially gain control of a server without a password. The flaw, identified as CVE-2026-98432, has been present since Linux version 4.4 and carries a severity score of 9.8 out of 10. The disclosure has drawn attention to the challenge of securing widely deployed operating systems as AI tools become capable of producing sophisticated attack code. Red Hat and several other Linux distributors have released fixes, but Ubuntu’s security tracker continues to list versions from 16.04 to 26.10 as vulnerable. This article outlines what the attack does, how the underlying bug works, which systems and software features matter, and what the available security guidance says. The central issue is broader than one AI-generated exploit or one networking feature: the underlying flaw may affect systems beyond the conditions used in Anthropic’s demonstration.

Lazy bag

Anthropic reports that Claude produced a Linux exploit capable of reaching root-level access on a vulnerable server over the internet, without requiring a password. The attack targets CVE-2026-98432, a race-condition flaw present since Linux version 4.4 and rated 9.8 out of 10. Its demonstrated method uses multipath TCP (MPTCP), a feature enabled by default in programs written in Go since Go 1.24, but the Go Security Team warns the underlying bug is not exclusive to MPTCP. Red Hat issued fixes on Sunday, Nov. 1, and other distributions have shipped patches for at least some versions. Ubuntu lists versions 16.04 through 26.10 as vulnerable, with fixes in progress for some releases and no release date shown. Upgrading to a patched kernel is the recommended durable defense.

Main Body

Anthropic’s disclosure places a newly demonstrated Linux exploit within a wider discussion about the capabilities and risks of AI-generated security research. The company said Claude created a working attack that could allow a remote stranger to take full control of a Linux server, without a password. The vulnerability is CVE-2026-98432. It has reportedly existed in Linux since version 4.4 and is rated 9.8 out of 10 for severity. Because Linux powers a large number of servers, the issue has implications for organizations that rely on Linux distributions to operate internet-facing systems.

Anthropic described the research on Oct. 27 in a post examining five targets: Chrome, Safari, Android, Windows, and Linux. According to the company, Claude wrote the Linux exploit after receiving initial prompts and used an unreleased internal model. The report says the attack can take less than an hour to locate a hidden area in computer memory, followed by five more minutes to execute a command with the highest level of system access, known as root. These details describe the reported demonstration; the practical risk to an individual system depends on its kernel, configuration, exposed services, and available security updates.

The Linux flaw is described as a race condition involving information that one part of a system discards while another part is still using it. AlmaLinux likened the behavior to trying to read a sticky note after someone has already shredded it. In the reported attack, a specially crafted message associated with opening an internet connection can trigger the problematic timing. When operations occur in an unexpected order, the system may handle data in a way that enables an attacker to interfere with its normal protections.

A significant feature of the reported vulnerability is that an unsuccessful attempt does not necessarily bring down the affected system. Anthropic said, “An enabling property of this race condition is that a lost race only fails the handshake without crashing the whole system,” adding that a persistent attacker can retry until successful. In other words, the failure mode described by the researchers may leave the server running rather than causing an obvious outage. That can make the issue harder to identify through availability monitoring alone, while allowing repeated attempts to remain possible.

The specific exploit Anthropic demonstrated relies on a server using multipath TCP, or MPTCP. This networking feature allows a single connection to use multiple routes at once. The Go Security Team says programs written in Go have enabled MPTCP by default since Go 1.24, a detail that may increase the relevance of the demonstrated approach for some Go-based services. This does not mean every Go application is automatically exploitable: the conditions present on the target system still matter, and operators should assess their own deployment rather than assume exposure or safety based on a programming language alone.

Crucially, the Go Security Team cautioned against treating MPTCP as the full scope of the issue. “While the demonstrated exploit requires the target system to expose an MPTCP listener, the underlying bug is not specific to MPTCP,” the team wrote. This distinction matters because an exploit demonstration shows one way to trigger a flaw, not necessarily every way the flaw could be reached. Systems that do not expose the exact listener used in the reported attack may still need to install the relevant kernel update. Security teams should therefore follow vendor advisories and patched-kernel guidance instead of relying only on disabling the feature used in one proof of concept.

Patch availability differs among Linux distributions. Red Hat released fixes for RHEL 8, 9 and 10 on Sunday, Nov. 1, including RHSA-2026:93412. Debian, SUSE, Oracle Linux and Amazon Linux have also shipped fixes, at least for some versions. The presence of a fix for one release does not establish that every version from a distribution is covered. Administrators should identify the exact operating-system release and kernel in use, consult the distribution’s security notice, and apply the update designated for that system.

Red Hat also published a temporary firewall rule for systems that cannot yet be updated. The company says the rule “reduces exposure to this vulnerability but cannot fully prevent it,” and noted that a complete working solution remains under development. A mitigation can be useful when patching must wait for operational reasons, but it should not be mistaken for a complete replacement for a fixed kernel. Organizations using temporary controls should document them, restrict relevant network exposure where feasible, monitor for vendor updates, and plan to remove or revise the mitigation once a supported fix is installed.

Ubuntu’s tracker presents a notable gap between the availability of fixes elsewhere and the status shown for its releases. Ubuntu continues to list versions from 16.04 to 26.10 as vulnerable. Its tracker indicates that fixes are in progress for 22.04, 24.04, 26.04 and 26.10. For 20.04, 18.04 and 16.04, the tracker shows only “Vulnerable,” and does not provide a release date for any fix. Those entries describe the status recorded by the tracker at the time of the report; they do not establish when a future update will be available. Ubuntu users should check the current security notice and system update channels for changes.

For Linux administrators, the practical steps are straightforward but require attention to detail. First, inventory systems and determine which kernels and distribution releases are running. Next, check the relevant vendor advisory for CVE-2026-98432 and install the patched kernel where one is available. If an update cannot be applied immediately, review temporary mitigations and network exposure, while recognizing that the Red Hat firewall rule is described as reducing rather than eliminating risk. Teams should also consider the Go Security Team’s warning that the flaw is not limited to MPTCP, so disabling MPTCP alone should not be treated as proof that a system is secure.

The report also fits into a broader pattern of AI-assisted vulnerability research. Anthropic’s earlier Claude Mythos model helped Mozilla find 271 bugs in Firefox, as Decrypt reported in April. That earlier example and the Linux disclosure illustrate how AI systems can contribute to finding or developing security issues. They also reinforce the importance of responsible disclosure, timely vendor coordination, and clear public guidance. AI may accelerate parts of research, but the security outcome still depends on whether affected software is identified, patches are prepared, and system operators install them.

Overall, the disclosure should be understood as both a warning about a severe kernel flaw and a reminder to distinguish a demonstrated attack path from the full scope of a vulnerability. Claude’s reported exploit used MPTCP, but the underlying bug is not specific to that feature. Red Hat and other vendors have released fixes for at least some systems, while Ubuntu’s tracker continues to mark releases from 16.04 to 26.10 as vulnerable. For affected systems, the recommended long-term response is to move to a patched kernel as soon as the appropriate vendor update is available.

Key Insights Table