# Anthropic reports Claude-assisted vulnerability research as fixes reach vendors > Anthropic reports Claude-assisted security research; vendor records show individual fixes and package status. By BIGCHANGE.AI Editorial Published: 2026-10-29T01:20:38.656Z Updated: 2026-10-29T01:20:38.656Z Canonical: https://bigchange.ai/blog/anthropic-claude-vulnerability-research-vendor-fixes ![Conceptual illustration of a generic rack-mounted server with an orange status light.](https://bigchange.ai/api/media/file/vulnerability-server-hero-v1.png) AI-generated conceptual illustration by BIG CHANGE; no actual research setup, attack or patch is depicted. Anthropic reports that an unreleased Claude research model helped find software vulnerabilities and produce exploit chains. Vendor advisories confirm individual issues. ## The big change - The reported Linux exploit targets a multipath TCP listener, giving defenders a specific service to investigate when assessing exposure. - A fix in an upstream project does not establish that an installed system has received it. Security teams need the relevant distribution's package status and their own deployed version to assess exposure. - A vendor credit can guide defenders to an individual advisory and affected product. The advisory and a research proof of concept answer different questions: one records a fix, while the other describes how flaws were combined. ## The Linux chain and its fix [Anthropic says](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude) Claude wrote a proof of concept after initial prompting. It targeted a server with a multipath TCP listener and required neither credentials nor user interaction. The listener condition narrows the relevant exposure; not every Linux server fits this test. The company describes using the race twice: first to leak a kernel address, then to redirect execution and run a command as root. The address leak helps defeat kernel address randomization, a protection that makes useful code locations harder to predict. BIG CHANGE did not run the proof of concept. The [upstream Linux fix](https://github.com/torvalds/linux/commit/e3f33b0a1d89d738e2b913dab519226eaf76e15b) describes the underlying race: one processor can still read connection options after another has freed them. A stale reference can therefore point into memory that no longer belongs to the object the reader expects. The change delays freeing those options until existing readers have finished. Linux’s [RCU documentation](https://cdn.kernel.org/doc/html/latest/RCU/rcu.html) explains that this waiting period lets existing readers finish before memory is reclaimed. The commit credits Anthropic researcher Xinyang Ge for the report; its description and code change establish a fix for the issue, not the complete exploit or the division of work between researcher and model. The issue is tracked as CVE-2026-98432. A distribution's package can lag the upstream change. On October 29, [Ubuntu's tracker](https://ubuntu.com/security/CVE-2026-98432), last updated October 28, listed the standard `linux` packages for Ubuntu 24.04 LTS and 22.04 LTS as vulnerable with work in progress. Other kernel packages and releases have their own rows. An operator must compare the relevant distribution row with the package installed and the kernel actually running. An available update is a separate step from running it: [Ubuntu explains](https://ubuntu.com/security/livepatch/docs/client/explanation/troubleshooting/do-i-need-to-reboot/) that upgrading to a newer kernel requires a reboot; live patches have their own coverage. Check the current advisory and live-patch status for the exact kernel before deciding remediation. ## What browser advisories establish Google's [October 20 Chrome 156 desktop release](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html) lists a critical accessibility use-after-free, CVE-2026-113271, reported by Ge with Claude's assistance. It lists other reports with the same attribution. Google says the release rolls out over days or weeks and may restrict bug details until users are updated. A release announcement therefore establishes the fixes listed for that release, while actual browser version and rollout determine what a user has installed. [Apple's iOS and iPadOS 26.5.2 security notes](https://support.apple.com/en-us/127594) list CVE-2026-43715 as a WebKit use-after-free addressed with improved memory management, crediting Milad Nasr and Nicholas Carlini with Claude at Anthropic. The update was released June 29 for the devices listed in Apple's advisory. The advisory documents this individual fix. ## Research result and operational evidence Vendor advisories do not provide a complete independent record of prompts, interventions or reproducibility. BIG CHANGE reviewed the public documents and did not run the exploits. The results are related to BIG CHANGE's earlier coverage of [an AI cyber evaluation that reached a real maintainer](https://bigchange.ai/blog/aisi-anthropic-ai-cyber-test-real-maintainer) and [Anthropic's opt-in OSS Scanner](https://bigchange.ai/blog/anthropic-oss-scanner-maintainer-enrollment-triage-guide), but concern a separate research disclosure. ## Sources - [Anthropic: Discovering and exploiting vulnerabilities with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude) — October 27 company account of research cases and testing; BIG CHANGE did not independently reproduce the exploits. - [Linux: IPv4 options lifetime fix](https://github.com/torvalds/linux/commit/e3f33b0a1d89d738e2b913dab519226eaf76e15b) — Upstream change and technical explanation for the reported race; credits Xinyang Ge. The commit does not document the entire exploit chain. - [Ubuntu: CVE-2026-98432](https://ubuntu.com/security/CVE-2026-98432) — Package-specific status, last updated October 28 when checked October 29. Rows may change; the technical description reproduces upstream material. - [Google: Chrome 156 desktop stable update](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html) — Lists individual security fixes and reporter credits for Chrome 156 desktop, and describes staged rollout; it does not verify the complete reported exploit chain. - [Apple: iOS and iPadOS 26.5.2 security content](https://support.apple.com/en-us/127594) — Lists affected device families and the WebKit fix credited to Anthropic researchers with Claude. The advisory supports an individual fix, not the entire reported chain. - [Linux kernel documentation: RCU concepts](https://cdn.kernel.org/doc/html/latest/RCU/rcu.html) — Explains grace periods and safe reclamation generally; it is not evidence that the proof of concept was reproduced. - [Ubuntu Livepatch: When to reboot](https://ubuntu.com/security/livepatch/docs/client/explanation/troubleshooting/do-i-need-to-reboot/) — Explains reboot requirements for a newer kernel and the limits of Livepatch; check the specific CVE and running kernel for applicable coverage.