Anthropic's unreleased Claude turned a Linux kernel bug into remote root in 53 minutes

Anthropic reported that an unreleased Claude model chained a Linux kernel race condition in CVE-2026-98432 into unauthenticated remote root on an MPTCP listener in 53 minutes, according to a disclosure shared on X by Shopify co-founder and chief executive Tobi Lutke on October 31st. The upstream fix existed, but Ubuntu and RHEL had not shipped a fixed kernel as of October 31st, leaving MPTCP listeners, including default Go listeners, exposed until kernels are updated and hosts rebooted. Lutke called the flaw "What a disaster" in his thread.

Anthropic's unreleased Claude turned a Linux kernel bug into remote root in 53 minutes Anthropic says the exploit reached root on an MPTCP listener in 53 minutes, while Ubuntu and RHEL still had no fixed kernel as of October 31st. By Ryan Merket https://runtimewire.com/author/ryan-merket · Published Primary source: x.com https://x.com/tobi/status/2116638054899208685 Why it matters A frontier model chaining a kernel race condition into unauthenticated remote root lowers the specialist skill needed to build working exploits. The immediate operational issue is patch lag: the upstream fix exists, but major distributions had not shipped it as of October 31st, leaving MPTCP listeners, including default Go listeners, exposed until kernels are updated and hosts rebooted. Shopify co-founder and chief executive Tobi Lutke @tobi https://x.com/tobi called CVE-2026-98432 "What a disaster" in a thread on X https://x.com/tobi/status/2116638054899208685 on October 31st, linking to Atlas coverage of the Linux kernel flaw https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf . Lutke, who co-founded Shopify after starting the Snowdevil snowboard shop with partners in 2004, was reacting to the disclosure rather than reporting the bug himself.… When you purchase through links in our articles, we may earn a small commission https://runtimewire.com/affiliate-monetization-standards . This doesn’t affect our editorial independence.