Anthropic AI Develops Linux Exploit as Ubuntu Remains Vulnerable to CVE-2026-98432

Security researchers at Anthropic have demonstrated that an internal AI model can successfully generate a working exploit targeting a long-standing vulnerability in Linux. The flaw, identified as CVE-2026-98432, has existed since Linux version 4.4 and carries a high severity score of 9.8 out of 10. While users often look for Claude built in tools to assist with development, this instance highlights how AI can also be utilized to identify and weaponize complex software weaknesses.

In a research post published on October 27, Anthropic detailed how its AI model crafted an attack capable of granting an unauthorized user full root-level control over a Linux server without requiring a password. The process involves identifying a specific memory vulnerability that functions similarly to reading a shredded document; one system component discards data while another simultaneously attempts to access it. By sending a specially crafted message, an attacker can trigger this race condition. Because failed attempts do not crash the system, attackers can retry the process indefinitely until they gain access, typically within an hour of initial probing.

Understanding the Claude Built in Tools and Security Risks

Although the demonstrated exploit specifically targets systems using multipath TCP—a feature enabled by default in Go 1.24—the underlying security flaw is broader than this single implementation. The Go Security Team has confirmed that while the MPTCP listener is the current vector, the core issue persists elsewhere in the system. The attack requires only a few minutes to elevate privileges to the highest level once the memory gap is located.

Anthropic's AI created a Linux exploit that grants root access without a password, leaving many servers vulnerable.

Industry responses to the discovery have been varied. Red Hat released security updates on Sunday for RHEL 8, 9, and 10, and other distributions including Debian, SUSE, Oracle Linux, and Amazon Linux have also provided fixes. However, Ubuntu users face a more precarious situation. The official Ubuntu tracker indicates that while patches are in development for some versions, older releases like 20.04, 18.04, and 16.04 are currently listed as vulnerable with no projected release date for a fix.

Why it matters

This vulnerability poses a significant risk to the stability and security of countless servers running Linux, which serves as the backbone for much of the internet. The inability to immediately patch widely used distributions like Ubuntu leaves systems exposed to potential unauthorized control.

For administrators, the absence of a comprehensive fix necessitates immediate caution. Red Hat has provided temporary firewall rules to reduce exposure, though they do not offer full protection. Organizations must monitor their specific Linux distributions closely as they wait for official security updates to mitigate this severe threat.