Anthropic says Claude built a working attack against a decade-old Linux flaw

Anthropic says its AI model Claude wrote a working attack that lets a stranger take full control of a Linux server over the internet, with no password needed. The bug behind it, tracked as CVE-2026-98432, has existed since Linux version 4.4 and scores 9.8 out of 10 on the severity scale.

Anthropic described the attack on Oct. 27 in a research post that covered five targets: Chrome, Safari, Android, Windows, and Linux. The company says Claude wrote the Linux exploit after initial prompting, using an unreleased internal model.

Key details at a glance

• The bug, CVE-2026-98432, has been present since Linux version 4.4 and carries a 9.8/10 severity score.
• Anthropic says the attack finds a hidden spot in the computer's memory in under an hour, then runs a command with the highest level of access (known as root) in about five more minutes.
• Anthropic's version of the attack requires the server to use a feature called multipath TCP (MPTCP), which lets one connection travel over several network routes at once.
• Red Hat has released fixes; Ubuntu lists every version from 16.04 to 26.10 as still vulnerable.

What Anthropic's research post says

Anthropic is the primary source here, and its post describes the attack in detail. The flaw is a "race condition": per AlmaLinux, one part of the system throws away a piece of information while another part is still using it. A specially crafted message that opens an internet connection can set that off.

Retrying the attack costs the attacker almost nothing. "An enabling property of this race condition is that a lost race only fails the handshake without crashing the whole system," Anthropic wrote, "so a determined attacker can retry indefinitely until they succeed."

What other vendors are saying

The Go Security Team, whose programming language has switched MPTCP on by default since Go 1.24, says the demonstrated exploit requires the target system to expose an MPTCP listener. But it warns the bug itself is not limited to that feature: "While the demonstrated exploit requires the target system to expose an MPTCP listener, the underlying bug is not specific to MPTCP." The team says the best fix is to upgrade to a patched kernel.

Red Hat released fixes for RHEL 8, 9, and 10 on Sunday, Nov. 1, including RHSA-2026:93412. Debian, SUSE, Oracle Linux, and Amazon Linux have also shipped fixes, at least for some versions.

Ubuntu's own tracker still lists every version from 16.04 to 26.10 as vulnerable. Fixes are marked as in progress for 22.04, 24.04, 26.04, and 26.10, while versions 20.04, 18.04, and 16.04 show only "Vulnerable," with no release date given for any fix.

What is confirmed

• The bug CVE-2026-98432 exists in Linux since version 4.4, per Anthropic and vendor trackers.
• Anthropic says Claude, using an unreleased internal model, wrote a working Linux exploit described in its Oct. 27 post.
• Red Hat shipped fixes for RHEL 8, 9, and 10 on Nov. 1, and Debian, SUSE, Oracle Linux, and Amazon Linux have released fixes for some versions.
• Ubuntu's tracker shows no fixes released yet for any of its versions.

What is still unclear

• Ubuntu has not announced release dates for its fixes.
• Whether the attack can be adapted beyond the MPTCP path is not settled; Anthropic's demo used MPTCP, but the Go Security Team says the underlying bug is broader.

Why this matters

Linux runs countless servers, and Ubuntu is one of its most popular versions. A remote attack that grants full control without a password, and that can be retried indefinitely without crashing the system, is a serious risk for any unpatched server. The report also adds to the record of AI models finding and writing real exploits: Anthropic's earlier Claude Mythos model helped Mozilla find 271 bugs in Firefox, as Decrypt reported in April.

What admins can do now

Red Hat published a temporary firewall rule for anyone who cannot update yet. It "reduces exposure to this vulnerability but cannot fully prevent it," Red Hat says in its security bulletin, and a full workaround is still under development. The Go Security Team's recommendation is to upgrade to a patched kernel as soon as one is available for your system.

Sources

• Decrypt