Claude Cracks Linux’s Digital Sticky Note—Now Ubuntu Users Need the Patch 🐧

Anthropic said an AI system built with Claude developed a working exploit for CVE-2026-98432, a Linux vulnerability rated 9.8 out of 10 that can allow an attacker to take full control of a server over the internet without a password. The flaw has existed since Linux version 4.4, while Ubuntu’s tracker still lists versions 16.04 through 26.10 as vulnerable.

Anthropic described the Linux exploit on Oct. 27 in a research post covering five targets: Chrome, Safari, Android, Windows, and Linux. Claude created the exploit after initial prompting using an unreleased internal model. The attack takes less than an hour to locate the vulnerable area in memory and five additional minutes to execute a command with root privileges.

The issue is a race condition in which one part of the system discards information that another part is still using, according to AlmaLinux. A specially crafted message that opens an internet connection can trigger the flaw. “An enabling property of this race condition is that a lost race only fails the handshake without crashing the whole system,” Anthropic wrote, “so a determined attacker can retry indefinitely until they succeed.”

Anthropic’s demonstrated exploit requires a server exposing a multipath TCP, or MPTCP, listener, a feature that allows one connection to travel over multiple routes. Go programs have enabled MPTCP by default since Go 1.24, according to the Go Security Team. “While the demonstrated exploit requires the target system to expose an MPTCP listener, the underlying bug is not specific to MPTCP,” the Go Security Team wrote.

Red Hat released fixes for RHEL 8, 9 and 10 on Sunday, including RHSA-2026:93412, while Debian, SUSE, Oracle Linux and Amazon Linux have also shipped fixes for at least some versions. Ubuntu’s tracker shows fixes in progress for 22.04, 24.04, 26.04 and 26.10, while versions 20.04, 18.04 and 16.04 remain listed as vulnerable. Red Hat also published a temporary firewall rule that “reduces exposure to this vulnerability but cannot fully prevent it,” with a full working solution still under development.

Mozilla separately said an early version of Anthropic’s Claude Mythos AI helped identify 271 vulnerabilities in the Firefox browser during internal testing, according to a Tuesday blog post. Those bugs were patched this week, highlighting how advanced AI systems are being used to analyze browser security issues.