AI‑found zero‑click Linux exploit

An internal report and CVE (CVE-2026-98432) document a Linux IPv4 TCP use‑after‑free vulnerability that an internal Claude model reportedly turned into a working zero‑click remote root exploit for servers with a multipath TCP listener. The disclosure highlights that language models can generate high‑risk offensive code, exploitability depends on server configuration and distro patch status, and remediation is time‑sensitive across distributions and deployments. — This concretely reframes debates over AI capability limits, vulnerability disclosure, and platform/provider responsibilities because it shows models can produce weaponizable exploits that intersect with software‑supply‑chain and patch‑management politics.