1. What did Claude actually build?
Anthropic has disclosed that its Claude model produced a functioning Linux exploit that lets an unknown remote party take complete control of a server over the internet, with no password required. The flaw is tracked as CVE-2026-98432, carries a severity score of 9.8 out of 10, and has been present in the Linux kernel since version 4.4. Red Hat shipped fixes on November 1, while Ubuntu still has none available.
The finding matters on two levels. First, the vulnerability itself reaches a very large installed base, because Linux underpins a substantial share of the world's servers. Second, the exploit was not hand-built by a human researcher over weeks of effort. Anthropic says Claude wrote it after initial prompting, using an unreleased internal model, which adds to the growing evidence that AI systems can now turn a known weakness into a working attack.
2. Where does the research come from?
The work was laid out in an Anthropic research post published on October 27. That publication did not focus on Linux alone. It examined five targets in total: the Chrome and Safari browsers, the Android and Windows operating systems, and Linux. The Linux case is the one now drawing the most attention, largely because a patch gap remains open for one of the most widely used distributions.
For readers unfamiliar with the vocabulary, a CVE identifier is simply a catalogue number assigned to a publicly known security flaw so that vendors, researchers and administrators can all refer to the same issue. The 9.8 score belongs to the Common Vulnerability Scoring System, where anything above 9.0 is rated critical. A bug that can be reached remotely, needs no credentials and hands over full control sits at the very top of that scale, which explains the rating assigned here.
3. Why does a kernel flaw like this carry so much weight?
The Linux kernel sits at the center of the operating system, managing memory, networking and the permissions that separate one program from another. A weakness inside it is therefore more serious than a flaw in an ordinary application, because a successful attacker is not confined to a single program. Instead, the attacker inherits the authority of the system itself, and the usual barriers between user accounts, containers and services can stop providing protection.
Servers are the places where this matters most. Web hosts, databases, cloud instances and internal business systems commonly run Linux, and many are reachable from the internet around the clock. Ubuntu is a frequent choice among them, which is why its patch status draws so much attention. An unauthenticated remote attack against such machines is the kind of scenario that security teams rank above nearly everything else when deciding what to fix first.
Version history adds to the concern. A flaw that has existed since Linux 4.4 spans many years of kernel releases, and long-lived deployments tend to include old kernels that were never refreshed. Ubuntu 16.04, one of the releases listed as vulnerable, is a good example of a platform that many organizations still operate well after its peak popularity.
4. How fast and how reliable is the attack?
Speed is a notable part of the description. According to Anthropic's account, the attack needs less than an hour to locate a hidden region of the machine's memory. Once that step is done, it needs only around five minutes to run a command with root privileges, the highest level of access on a Linux system. Root access means an intruder can read, change or delete essentially anything on the machine, install persistent tools and use the server as a launch point against other systems.
Reliability is aided by the way the underlying bug behaves when an attempt goes wrong. Anthropic noted that a lost race only fails the handshake without crashing the whole system. In practice this means a failed try costs the attacker almost nothing and leaves no obvious sign such as a crash or a reboot. The attacker can simply repeat the attempt as many times as needed until the timing works in their favor, which makes an otherwise delicate technique far more practical.
The practical effect is that defenders have little room for error. A technique that is quick to run, repeatable and quiet in failure leaves few opportunities to notice an attempt before it succeeds. Monitoring can still help, for instance by flagging unusual bursts of failed connection handshakes against a single host, but prevention through patching remains the more dependable approach.
5. How does the underlying flaw work?
The flaw has been described with an everyday analogy: it resembles reading a sticky note after the note has already been shredded. One part of the operating system throws a piece of data away, while another part is still relying on it. Programmers call this class of mistake a race condition combined with use of freed memory, since two components compete over the same resource and the loser acts on information that no longer exists.
According to AlmaLinux, a specially crafted message that opens a network connection is enough to set off this timing failure. That detail explains why the bug can be reached from the internet rather than only by someone who already has an account on the machine. A server does not need to be misconfigured in an obvious way for a hostile packet to arrive at the vulnerable code path, provided the necessary networking feature is switched on.
6. Which servers are exposed, and what role does MPTCP play?
The version of the attack that Anthropic built depends on a server running multipath TCP, usually shortened to MPTCP. This is a networking feature that allows a single connection to travel over several routes at once, which can improve resilience and throughput. It is not obscure in modern deployments. The Go Security Team states that programs written in Go have had it enabled by default since Go 1.24, so many services may be listening in this mode without their operators having chosen it deliberately.
The same team cautions against reading the issue too narrowly. In its assessment, the demonstrated exploit requires an MPTCP listener, but the underlying bug is not specific to MPTCP. That distinction implies that administrators who have confirmed MPTCP is off should not assume they are safe. The Go Security Team's recommended remedy is straightforward: move to a patched kernel as soon as one is available for the distribution in use.
7. Who has patched, and what can administrators do now?
Red Hat released fixes on Sunday, November 1, for Red Hat Enterprise Linux 8, 9 and 10, under advisory RHSA-2026:93412. Debian, SUSE, Oracle Linux and Amazon Linux have also published fixes, at least for some of their supported versions. Administrators on those platforms should check which of their releases are covered and schedule kernel updates and reboots accordingly, since a kernel fix does not take effect until the machine restarts into it.
For users who cannot update immediately, Red Hat has published a temporary firewall rule. It lowers exposure but cannot fully prevent exploitation, and the company is still developing a complete workaround. The interim guidance is tracked in security bulletin RHSB-2026-016. Security teams generally treat such measures as a bridge to buy time, not a replacement for the real fix, and the advisory language here points the same way.
8. Why is Ubuntu the sticking point?
Ubuntu is among the most popular Linux distributions, and its own security tracker lists every version from 16.04 through 26.10 as vulnerable. Fixes are in progress for 22.04, 24.04, 26.04 and 26.10. The older releases, 20.04, 18.04 and 16.04, display only the status Vulnerable, and the tracker offers no release date for a fix on any of the affected versions.
That leaves a stretch of time during which a public description of the technique exists, the weakness is rated critical, and a large population of Ubuntu servers has no official patch to install. Operators of those machines are limited to mitigations and to watching the tracker for updates. The situation illustrates how disclosure timing, vendor release schedules and the arrival of AI-assisted exploit development can interact in ways that favor attackers, at least briefly.
Organizations running mixed fleets face a particular challenge. A company might use Red Hat for some workloads, Ubuntu for others and Amazon Linux in the cloud, each with a different patch status today. Keeping an accurate inventory of which kernel version and which networking features each machine uses is the first step toward deciding where to apply fixes and where to rely on the firewall measure.
9. What happens next?
The immediate question is when Ubuntu will publish kernel updates for its in-progress releases, and whether the unsupported or older versions will receive anything at all. No dates have been given, so administrators should monitor the distribution's security tracker and apply updates the moment they appear. Red Hat is also expected to refine its interim firewall guidance as its complete workaround is developed.
The broader lesson reaches beyond one bug. Anthropic's research shows an AI model producing a practical remote attack against a mainstream operating system, and the company examined four other major targets in the same effort. Defenders have long relied on the time and skill needed to weaponize a flaw as a buffer. If that effort shrinks to a prompt and an hour of compute, patch cycles that were once acceptable may need to become much faster.