# 53 Minutes to Root

Per Anthropic’s October 27 blog post, an unreleased Claude research model wrote a working remote-root exploit for CVE-2026-98432 — a kernel pointer leak plus callback corruption against MPTCP listeners, reaching a root shell with no credentials in about 53 minutes. The same research effort also yielded a one-click Chrome sandbox escape, a Safari chain, an Android lock-screen bypass, and a Windows HTTP/3 crash (CVE-2026-33096) — all fixed.

## Key facts

- Per Anthropic's October 27 blog post, an unreleased Claude research model wrote a working remote-root exploit for CVE-2026-98432.
- The exploit targeted MPTCP listeners, combining a kernel pointer leak with callback corruption to reach a root shell.
- No credentials were required for the attack to succeed.
- The reported timeline was about 48 minutes to achieve the pointer leak and 5 more minutes to reach root — 53 minutes total.
- The same research effort also produced a one-click Chrome sandbox escape, a Safari chain, an Android lock-screen bypass, and a Windows HTTP/3 crash (CVE-2026-33096).
- All of the resulting findings were fixed.

Part of the CVE-2026-98432: the kernel flaw a research model exploited — cve 2026 98432 triage guide collection at https://aiservicesmarket.lol/cve-2026-98432/