A Claude-written exploit achieves remote root over Linux TCP through an MPTCP listener

On 15 October 2026, CVE-2026-98432, a use-after-free in IPv4 TCP present since Linux 4.4, was published. On 27 October, Anthropic showed that a Claude-written exploit runs commands as root, without authentication, on servers listening with MPTCP — which Go 1.24+ programs do by default.