Anthropic's unreleased Claude turned a Linux kernel bug into remote root in 53 minutes
Anthropic says the exploit reached root on an MPTCP listener in 53 minutes, while Ubuntu and RHEL still had no fixed kernel as of October 31st.
By Ryan Merket · Published
Primary source: x.com
Why it matters
A frontier model chaining a kernel race condition into unauthenticated remote root lowers the specialist skill needed to build working exploits. The immediate operational issue is patch lag: the upstream fix exists, but major distributions had not shipped it as of October 31st, leaving MPTCP listeners, including default Go listeners, exposed until kernels are updated and hosts rebooted.
Shopify co-founder and chief executive Tobi Lutke (@tobi) called CVE-2026-98432 "What a disaster" in a thread on X on October 31st, linking to Atlas coverage of the Linux kernel flaw. Lutke, who co-founded Shopify after starting the Snowdevil snowboard shop with partners in 2004, was reacting to the disclosure rather than reporting the bug himself.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.