WORLDTECHAnthropic says Claude-built Linux exploit hits unpatched Ubuntu
Anthropic says its Claude model wrote a working attack that can give an outside party full control of a Linux server over the internet without a password. The flaw behind it, CVE-2026-98432, is still listed as vulnerable across Ubuntu releases.
What the flaw allows
According to Anthropic, the attack lets a stranger reach full control of a Linux server across the internet and requires no password. The bug, catalogued as CVE-2026-98432, has existed in Linux since version 4.4 and carries a severity score of 9.8 out of 10.
The attack reportedly needs less than an hour to locate a hidden spot in the computer's memory, followed by about five minutes to run a command with root, the highest level of access.
Ubuntu and Red Hat response
Red Hat released fixes on Sunday. Canonical, which develops Ubuntu, had not yet provided one, and Ubuntu's own tracker still lists every version from 16.04 to 26.10 as vulnerable.
How the race condition works
Per AlmaLinux, one part of the system discards a piece of information while another part is still using it. A specially crafted message that opens an internet connection can trigger this. Anthropic notes that a failed attempt only breaks the handshake without crashing the system, so an attacker can retry until it succeeds. The exploit reportedly requires a server using multipath TCP, a feature that lets one connection travel over several routes at once.
Claude's role and current status
Anthropic says Claude wrote the exploit after initial prompting, using an unreleased internal model. A complete working solution is still under development, according to the reporting.
Open questions
- When will Canonical release a fix for Ubuntu?
- How many servers running the affected configuration are exposed?