Anthropic's unreleased Claude built a remote root exploit for Linux

Anthropic has disclosed a zero-click exploit for the Linux kernel, built with an unreleased Claude research model, that lets an unauthenticated attacker run arbitrary commands as root without any user interaction. The flaw, tracked as CVE-2026-98432, carries a critical severity score of 9.8 and affects Linux servers running a multipath TCP listener.

This is the fifth of the attack chains Anthropic described this week. The previous Unicorn API article covered the Chrome sandbox escape and the Safari data-theft chain. Since then, coverage has filled in the details of the Linux chain, the most serious of the five in terms of impact, including how the kernel bug works, which kernel versions carry the fix, and which Linux distributions still had not shipped patched kernels as of October 30.

What Anthropic says its model did on Linux

According to Anthropic, the model turned a single kernel bug into a full remote takeover. Its demonstration shows an attacker leaking kernel memory, defeating Kernel Address Space Layout Randomization (KASLR, a defence that shuffles where kernel code sits in memory so attackers cannot predict it), hijacking kernel control flow and finally running an attacker-chosen shell command.

The Hacker News describes the same sequence: the model first leaks a kernel memory address to get past KASLR, then reuses the same race-condition bug to redirect execution to code the attacker has already placed, resulting in a root shell. “Zero-click” here means no one on the target machine has to do anything; the attack arrives over the network and needs no login.

Timing is one of the more concrete details. Anthropic says its proof of concept took 48 minutes to leak the address and five more to reach the shell, or roughly 53 minutes from the initial memory leak to root-level command execution, as CSO Online puts it, citing Anthropic’s blog post. Anthropic also says a failed attempt does not crash the system, so an attacker can keep retrying. That matters for defenders: a noisy crash is often the first sign of an exploit attempt, and this chain is designed not to produce one.

The five chains in context

The Linux work is part of Anthropic’s broader effort to measure how well AI models can discover and exploit vulnerabilities in widely deployed software, with five chains covering Chrome, Safari, Android, Windows and Linux. Anthropic’s Frontier Red Team described the chains in a research post, and the exploits were built in the lab after the model was prompted, not observed in real attacks.

Platform	What the exploit does	Condition it needs
Chrome	Runs code outside the browser’s sandbox from one page visit	One click or page load, stock Chrome on macOS
Safari	Lets a website read data from other sites the user is signed in to	One visit to a malicious page
Android	Copies photos and other data off a locked, stolen phone	Physical access over USB
Windows	Crashes a server over the network and keeps it down	Server answers HTTP/3 requests
Linux	Runs commands as root over the network, no login, no user action	Server runs a multipath TCP listener

Source: The Hacker News’s summary of Anthropic’s report.

How the Linux kernel bug works

CVE-2026-98432 is a race-condition-induced use-after-free bug. A use-after-free happens when a program keeps using a piece of memory after it has been released; if an attacker can arrange for something else to occupy that memory, they can influence what the program does next.

According to the Linux kernel CVE advisory, as summarised by CSO Online, the flaw sits in how Linux handles IP options while setting up IPv4 TCP connections. When a new connection is created, the kernel can hand ownership of those options from the pending connection request to the new socket without making a separate copy. If another CPU is at the same moment processing a retransmitted connection request and using the same options to build a SYNACK reply (the second step of the TCP handshake), and the new socket is freed before that CPU finishes, the kernel reads memory that has already been released.

The upstream fix delays freeing the affected objects until after a read-copy-update (RCU) grace period, a kernel mechanism that waits until all concurrent readers are done before memory is reclaimed.

Why multipath TCP is the attack surface

Anthropic’s exploit specifically targets Linux servers running an MPTCP listener. Multipath TCP extends ordinary TCP so a device can use several network interfaces at once within a single connection, which allows bandwidth aggregation, better network selection, and failover when one path drops. On Linux, MPTCP is opt-in: applications must explicitly request it when they create sockets, although eBPF and other configuration techniques can also force applications to use it. That narrows the exposed population, but it also means administrators may not know whether some tooling on their machines has switched it on.

Patch status: fixed upstream, uneven in distributions

The fix landed upstream on October 15, 2026. The flaw affects eight Linux kernel branches dating back to version 4.4. Fixed upstream releases include:

• 5.10.272
• 5.15.223
• 6.1.190
• 6.6.159
• 6.12.113
• 6.18.56
• 7.2.10
• 7.3-rc7

Distribution packages are the practical question for most teams. Debian, Oracle Linux, SUSE and Amazon Linux have fixed kernel packages available for at least some releases, while Ubuntu and Red Hat Enterprise Linux had yet to release patched kernels as of October 30, according to CSO Online. Network security vendor Aviatrix lists the exploit status as proof of concept.

What can be verified, and what rests on Anthropic’s word

The evidence for this story comes in layers of different strength.

Verifiable: a kernel CVE exists, it is rated 9.8, and fixed releases are published. Across the wider set of chains, Apple and Google credit Anthropic and its Claude model for specific fixes, which can be checked with the vendors. Aviatrix calls those credits third-party validation.

Resting on Anthropic’s account: how much of each chain the model built on its own. Anthropic says the work needed only “initial prompting” and “little human involvement”, but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model. Sources frame this differently. Aviatrix, which sells network security products, describes the model as having “autonomously” chained zero-days with “minimal human prompting”, while The Hacker News stresses that readers cannot check the division of labour.

An open discrepancy: Anthropic ties its multipath TCP exploit to CVE-2026-98432, but the public record for that CVE describes an IPv4 TCP fix rather than a multipath TCP one, and the two are linked only by Anthropic’s post, The Hacker News reports. CSO Online’s account reflects the same split: the kernel advisory it cites discusses IPv4 TCP connection setup, while Anthropic’s exploit targets MPTCP listeners. Aviatrix’s CVE summary, by contrast, describes the bug as sitting in the multipath TCP listener implementation. None of the sources explains how the two descriptions fit together, so it is not yet clear whether servers without MPTCP listeners face any exposure through other paths.

What it means for builders

For teams running Linux infrastructure, including the servers behind AI-powered apps and API backends, the immediate steps are the ones CSO Online lists: review kernel versions, apply the relevant security updates, and check whether systems expose MPTCP listeners. Teams on Ubuntu or Red Hat Enterprise Linux should watch for vendor kernel updates, since those had not shipped as of October 30. Because a failed exploit attempt does not crash the machine, crash monitoring alone is not a reliable signal.

The broader point concerns timelines. Aviatrix argues that as attackers gain access to similar AI models, security teams should assume the gap between vulnerability disclosure and weaponised exploitation will shrink sharply, and it recommends network-layer controls such as egress enforcement and segmentation as compensating measures. That is a vendor’s interpretation, not a finding in Anthropic’s report, but the underlying claim it reacts to is Anthropic’s: that combining several separate flaws into a working exploit, until now the work of a few specialist teams, is something one model can do.

Anthropic presents the work as help for defenders. It says it reported each flaw under a coordinated disclosure policy that gives developers 90 days to patch and 45 more days before it discusses details beyond a public advisory, and it points security teams to its expanded Cyber Verification Program for vetted professionals.

What to watch next

• Ubuntu and Red Hat kernels. Whether and when these two distributions ship patched kernels, given they had not as of October 30.
• The CVE mapping. Whether kernel maintainers or Anthropic clarify how the IPv4 TCP fix in the public record relates to the multipath TCP exploit.
• The model itself. Anthropic has not named the internal research model or said how its human testers divided the work. Any release decision, or limits placed on its cyber capabilities, would be the next major development in this thread.
• Defender access. How the expanded Cyber Verification Program is used, and by whom.