Claude-Built Linux Exploit Targets Bug That Ubuntu Still Hasn't Patched

Anthropic has revealed that its Claude AI developed a functional exploit that enables attackers to take complete control of Linux servers over the internet without requiring a password. The vulnerability, identified as CVE-2026-98432, has been present in Linux since version 4.4 and carries a severity score of 9.8 out of 10.

The tech giant described the attack in a research post published on Oct. 27, which covered five targets: Chrome, Safari, Android, Windows, and Linux. Claude generated the Linux exploit using an unreleased internal model after initial prompting from researchers.

Exploit Mechanism

The attack operates by finding a hidden spot in the server's memory within less than an hour, then executing a command with the highest level of access (root privileges) in just five more minutes. The flaw works like reading a shredded sticky note—where one part of the system discards information while another part is still using it.

Patch Status

Red Hat has released fixes for RHEL 8, 9, and 10 (RHSA-2026:93412), while Debian, SUSE, Oracle Linux, and Amazon Linux have also shipped patches for some versions. However, Ubuntu's security tracker still lists every version from 16.04 to 26.10 as vulnerable, with fixes in progress only for 22.04, 24.04, 26.04, and 26.10.

The Go Security Team emphasized that while the demonstrated exploit requires multipath TCP (MPTCP)—a feature enabled by default in Go programs since version 1.24—the underlying bug is not limited to this functionality. They recommend upgrading to a patched kernel as the best solution.

For users unable to update immediately, Red Hat has published a temporary firewall rule that reduces exposure but cannot fully prevent exploitation. A complete solution is still under development. Ubuntu has not provided release dates for any of its pending fixes.