claude ai-safety linux-vulnerabilities developer-tools

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io

April 3, 2026

6 min read

🔥🔥🔥🔥🔥

65/100

Summary

Nicholas Carlini, a research scientist at Anthropic, utilized Claude Code to discover multiple remotely exploitable vulnerabilities in the Linux kernel, including one that remained hidden for 23 years. The findings include several remotely exploitable heap buffer overflows.

Key Takeaways

Claude Code identified multiple remotely exploitable security vulnerabilities in the Linux kernel, including one that had been hidden for 23 years.
The vulnerability discovered in the Linux NFS driver allows an attacker to read sensitive kernel memory over the network.
Nicholas Carlini utilized a simple script to direct Claude Code to analyze the Linux kernel source code for security vulnerabilities with minimal oversight.
The attack exploiting the NFS vulnerability requires two cooperating NFS clients to successfully read sensitive information from the Linux NFS server.

Read original article

View story →

Coverage & discussions

Hacker News · mtlynch.io

Claude Code Found a Linux Vulnerability Hidden for 23 Years ↗

Community discussions

Hacker News discussion ↗

Historical count: 5 · 5 saved in sample · Historical sample

Analysis ready

Community Sentiment

Negative

Positives

Claude Code's ability to discover a long-hidden Linux vulnerability demonstrates its potential for enhancing security in software development.
The model's capability to identify hundreds of potential bugs suggests significant promise for improving code quality and security.

Concerns

The high rate of false positives reported by Claude Code raises concerns about its reliability, potentially leading to wasted developer time and resources.
The cost associated with token usage may limit the accessibility of Claude Code for many companies, hindering widespread adoption for security purposes.
There are fears that Claude Code might inadvertently introduce more vulnerabilities than it resolves, questioning its overall effectiveness in security.