# Anthropic's unreleased Claude model built a root exploit for a Linux kernel bug in 53 minutes > Anthropic says an unreleased research model wrote a working remote root exploit for CVE-2026-98432, a Linux kernel flaw present since 4.4. Patches exist upstream, but Red Hat and Ubuntu are still catching up. > > OpenCheese AI · 2026.10.31 · Web page: https://opencheese.dev/blog/anthropic-s-unreleased-claude-model-built-a-root-exploit-for-a-linux-kernel-bug An unreleased research model from Anthropic was handed an initial task and then, on its own, produced a working exploit for a Linux kernel flaw that lets a remote stranger run commands as root. The attacker needs no account and no cooperation from a user, only a TCP connection to the server. Anthropic described the result on 27 October, and it has not published the exploit. ## The bug and who it reaches The flaw is tracked as CVE-2026-98432, and it has been in the kernel since version 4.4. That is a long time for a hole to sit in code that runs a large share of the world's servers. The US National Vulnerability Database rates it 9.8 out of 10 on the CVSS scale. Red Hat gives it 5.9. The reasoning behind the lower number is that an attacker has a hard time winning a race between processor cores. More on that below. ## Where the 53 minutes went In Anthropic's demonstration the target was a server with multipath TCP (MPTCP) enabled. The clock split into two unequal parts. - **About 48 minutes** went on getting around KASLR, the protection that places the kernel at a random spot in memory so an attacker cannot simply aim at a known address. - **Another five minutes** covered taking control of the machine and running a command as root. The sum is the 53 minutes in the headline. Defeating the randomisation took nearly all of it, and the actual takeover was an afterthought. The report does not say what the initial task was, how many attempts the model made, or what hardware it ran against. It also does not say who first found the bug. All it states is that the model, once given its starting task, built the working exploit without further help. ## How the flaw works The problem sits in the handling of IPv4 TCP connections. While a connection is being set up, two processor cores can touch the same data at the same moment. One core frees a piece of memory, and the other keeps reading it. This class of error is called use-after-free. It corrupts kernel memory, and under the right conditions it hands the attacker control over what code gets executed. The timing is the reason for Red Hat's lower score. The attacker has to land the two cores in exactly the wrong order, and that is not something you can count on in a single try. ## Why MPTCP shows up in the story MPTCP extends ordinary TCP so that one connection can move data over several network interfaces at once. Anthropic used it for the demonstration, but the vulnerability is not limited to that protocol. It was picked as a convenient way to show an attack launched from outside. The report gives no list of other configurations that are exposed, so administrators should not read the MPTCP detail as a boundary of the problem. ## Two scores for one bug A 9.8 and a 5.9 for the same flaw is quite a gap. The NVD figure treats the bug as close to the worst case on the scale. Red Hat's figure discounts it because winning the race is difficult. The source gives Red Hat's reasoning but no explanation for the NVD number, so there is no way to say from this report how each group arrived at its score. What the demonstration does show is that an automated attacker succeeded against a server with MPTCP turned on. Whether that settles the argument is left to the reader. ## Patches, and who has them Fixes are in the mainline Linux tree and in these stable kernel releases: - 5.10.272 - 5.15.223 - 6.1.190 - 6.6.159 - 6.12.113 - 6.18.56 - 7.2.10 - 7.3 Distributions are a different matter. Ubuntu is still preparing its update. Red Hat has postponed the patch for RHEL. Anyone running those systems has a fix that exists upstream but not yet in the package they actually install. ## Exploitation so far No attacks using CVE-2026-98432 have been reported. The vulnerability is also absent from CISA's catalog of actively exploited threats. The working exploit itself remains with Anthropic. For now, the distance between a vendor patch and a published exploit is the only buffer the unpatched systems have. ## Related posts - 2026.11.02 · [Open model GLM 5.3 turned unreleased Firefox patches into working exploits in Epoch AI test](https://opencheese.dev/blog/open-model-glm-5-3-turned-unreleased-firefox-patches-into-working-exploits.md): Epoch AI gave the open model GLM 5.3 a Firefox version number and public code changes. It built working exploits for six releases, each in 12 to 48 hours. A similar attack on Chrome failed. - 2026.10.19 · [Claude Mythos 5 designed quantum circuits that need far fewer gates than published ones](https://opencheese.dev/blog/claude-mythos-5-quantum-circuits-fewer-gates.md): Anthropic says Claude Mythos 5 optimised eight quantum routines in an automated loop, cutting gate counts up to 17-fold in some cases. The authors stress that this is circuit design, not a working quantum computer. - 2026.10.11 · [Anthropic Says Claude Tests Reached Real Police and Government Forms](https://opencheese.dev/blog/anthropic-says-claude-tests-reached-real-police-and-government-forms.md): Anthropic described tests in which Claude submitted forms to real websites and worked around technical restrictions. The company says the incidents had limited consequences and has since changed its evaluation safeguards.