Ubuntu stages fixes for Linux flaw Anthropic says its AI exploited

Ubuntu has moved fixes into testing for a Linux vulnerability that Anthropic says an unreleased AI model turned into a remote takeover. The November 2 update adds a practical qualification to Anthropic’s October 27, 2026 research disclosure: a fix in the Linux project does not mean every supported Ubuntu release has received the repair.

Anthropic’s disclosure described five laboratory exploit chains affecting Chrome, Safari, Android, Windows and Linux. Its central claim goes beyond finding individual bugs: an unnamed internal model combined weaknesses into working attacks after initial prompting. The results span different kinds of access, from copying data off a locked phone to running commands remotely with the highest system privileges.

Five chains, different kinds of access

The Chrome demonstration crossed several security boundaries. Anthropic says the model linked four flaws, starting with memory corruption in the browser’s JavaScript engine and ending outside the browser’s sandbox—the barrier designed to contain compromised web content. Its demonstration opened Calculator on a Mac within seconds of a page loading, without further interaction.

Safari illustrates a different route to sensitive information. Rather than execute arbitrary code, the chain altered browser memory to disable the same-origin policy, which keeps one website from reading another’s data. Anthropic says a malicious page could then read information from sites where the user was signed in. Some weaknesses were intended behaviors that became exploitable only in combination.

The Android attack required physical possession of a locked phone and a USB connection. Anthropic says the work combined source-code analysis, examination of proprietary Google Play services software and testing on a Pixel 9. The resulting chain bypassed transfer and pairing protections to extract photos and other personal data without unlocking the device.

Windows and Linux show why the outcome matters as much as the bug. The Windows demonstration could repeatedly crash machines responding to HTTP/3 requests through the native implementation; it was not a takeover. The Linux demonstration, by contrast, could run attacker-chosen commands as root—the highest level of control—on a server with a multipath TCP listener.

Anthropic says its Linux proof of concept needed 48 minutes to expose a kernel memory address and another five to execute a command. Failed attempts did not crash the target, allowing repeated tries. Those timings describe the exploit running against its target, not how long the model took to discover or build it.

Working exploits are not an autonomy score

The experiments were laboratory demonstrations, not observed attacks on victims, according to The Hacker News. Its examination also identifies the main limit on Anthropic’s capability claim: the company describes little human involvement but does not break down what people did at each stage. It does not identify the research model, either.

There is supporting evidence for specific contributions. The Hacker News notes that Google credits an Anthropic researcher assisted by Claude for particular Chrome fixes, while Apple credits two researchers working with Claude for a Safari fix. Those acknowledgments support participation in vulnerability research; they do not measure how independently the model assembled each complete chain.

Anthropic also describes substantial infrastructure around the model: parallel scanning agents, automated searches for related flaws and a standardized verification and risk-rating pipeline. For the Windows investigation, researchers supplied an executable and directed the model to reverse-engineer it before looking for vulnerabilities. The disclosed result is therefore a model-assisted research process, not an unqualified demonstration of hands-off discovery.

The Ubuntu Security Team believes that security updates are the only appropriate mitigation.

Ubuntu Security Team, November 2, 2026 update

An upstream fix is not a finished rollout

Anthropic says it reported every vulnerability to the affected vendor. It describes fixes from Apple, Google and Microsoft, and says the Linux repair was incorporated upstream and backported to maintained stable kernel branches. Its disclosure policy gives developers 90 days to patch, followed by another 45 before it discusses details beyond public advisories.

Ubuntu’s November 2 release-by-release status shows the remaining delivery work:

• Ubuntu 26.10 was listed as fixed.
• Ubuntu 22.04, 24.04 and 26.04 had fixes in the proposed package area, available for users running their own acceptance tests.
• Ubuntu 16.04, 18.04 and 20.04 were listed as awaiting fixes.

Ubuntu says it tests across more than 2,000 certified servers and devices before moving fixes into its regular updates area. It also warns against treating the demonstrated attack path as the full vulnerability: CVE-2026-98432 affects IPv4 TCP connection handling and is not specific to multipath TCP. Disabling multipath TCP therefore is not the remedy its security team endorses.