Anthropic Says Claude Built a Remote Root Exploit in 53 Minutes While Ubuntu Waits on a Fix

Anthropic says it pointed an unreleased research model at the Linux kernel's networking code and got back a working exploit that hands a remote stranger a root shell. No password, no click, about 53 minutes of attacking. That's the company's account, and it hasn't published the code.

The part that should bother anyone running servers is less about the model and more about the plumbing. The bug, tracked as CVE-2026-98432, was fixed upstream on October 5. As of Friday, Ubuntu's own security tracker still shows no fixed kernel for any release. Red Hat had none for RHEL 8, 9 or 10 either.

The flaw is a race condition in how the kernel sets up IPv4 TCP connections, and it dates back to Linux 4.4. In its October 27 write-up, Anthropic's Frontier Red Team said Claude produced the exploit after "initial prompting." The target was a Linux server with a multipath TCP listener. Leaking a kernel pointer took 48 minutes, and another five got the attacker to a shell command running as root. Anthropic did not say which kernel version or configuration it tested.

"An enabling property of this race condition is that a lost race only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed." Anthropic Frontier Red Team

That retry property is why this isn't a lab curiosity. A failed attempt doesn't take the machine down. The Hacker News reported that, as of October 29, no vendor advisory, the CVE record or Anthropic's post described attacks in the wild.

The fix exists. Your server may not have it.

Anthropic says the bug "was patched upstream and backported to all maintained stable kernel branches." True, and nearly useless to most admins, who run a distribution's kernel, not Linus's. Debian shipped fixes on October 16 and Oracle Linux did the same day. Amazon Linux 2023 and SUSE have fixes for some kernels, according to The Hacker News. Ubuntu lists 22.04, 24.04, 26.04 and 26.10 as work in progress, with 16.04 through 20.04 simply vulnerable, and rates the bug priority High.

Red Hat's week has been stranger. Its public CVE page first rated the flaw Moderate with a 5.9 score, and fixes were "deferred to a future update." On Friday the company published a security bulletin calling it Critical and saying it is expediting fixes. Red Hat didn't say what changed its mind. The kernel team's own score is 9.8, while Oracle and SUSE say 8.1 and Amazon says 7.0.

"Red Hat is expediting the release of fixes." Red Hat security bulletin RHSB-2026-016

Red Hat did offer a stopgap, an nftables rule that drops incoming IPv4 TCP packets carrying IP options. It warns the rule "reduces exposure to this vulnerability but cannot fully prevent it" and should be tested before use. Its own CVE page also adds a caveat that cuts against Anthropic's demo, saying reliably executing arbitrary code through this bug "requires precise heap control." Anthropic says its model managed it anyway. That claim is the company's, and the proof of concept stays private.

There's a second wrinkle for people who think they dodged this by never touching multipath TCP. The Go Security Team says programs built with Go 1.24 or later enable MPTCP by default on listening sockets on Linux. It also says the bug is not specific to MPTCP, so systems without MPTCP listeners may be open to similar attacks.

Anthropic frames this as a defender's story and urges teams to scan their own code first. Fair enough. The same lab recently said Claude found bugs by trying to prove code safe. The Linux case is the awkward flip side: finding and proving a flaw is now fast, while shipping a fix to the people who run the software is still slow. Upstream patched this bug three weeks before Anthropic went public, and some of the biggest distributions still hadn't caught up by Friday.

Vendor status is as of October 30 and can change quickly.