53 Minutes to Root

Per Anthropic’s October 27 blog post, an unreleased Claude research model wrote a working remote-root exploit for CVE-2026-98432 — a kernel pointer leak plus callback corruption against MPTCP listeners, reaching a root shell with no credentials in about 53 minutes. The same research effort also yielded a one-click Chrome sandbox escape, a Safari chain, an Android lock-screen bypass, and a Windows HTTP/3 crash (CVE-2026-33096) — all fixed.

Key facts

Per Anthropic's October 27 blog post, an unreleased Claude research model wrote a working remote-root exploit for CVE-2026-98432.
The exploit targeted MPTCP listeners, combining a kernel pointer leak with callback corruption to reach a root shell.
No credentials were required for the attack to succeed.
The reported timeline was about 48 minutes to achieve the pointer leak and 5 more minutes to reach root — 53 minutes total.
The same research effort also produced a one-click Chrome sandbox escape, a Safari chain, an Android lock-screen bypass, and a Windows HTTP/3 crash (CVE-2026-33096).
All of the resulting findings were fixed.