The event
On 27 October, Anthropic’s Frontier Red Team said an unreleased internal model had found flaws in Chrome, Safari, Android, Windows and Linux and chained them into five working exploits (The Hacker News; L’Usine Digitale). Every flaw was reported to the vendors first.
The Linux chain is the one boards should read. It runs commands as root on a server over the network, with no password and no user action, provided the server accepts multipath TCP connections. Anthropic says the first stage took 48 minutes and the takeover five more, and a failed attempt simply drops the connection, so an attacker can try again (L’Usine Digitale). The bug, CVE-2026-98432, sits in the kernel’s IPv4 TCP handling and has been there since Linux 4.4 (TuxCare).
What everyone is saying
Most of the coverage splits two ways. One camp reads it as proof that AI-driven attacks have arrived. The other, Anthropic included, reads it as good news for defence: the models that build exploits can find flaws first, so defenders should get them early.
Both camps agree on one thing. The model is the story. A smaller, sceptical camp asks how much a person did at each step; it is closer to the point.
The contrarian read
It is not. The model is the part you do not control. Look at the part you do.
The Linux fix landed upstream on 5 October. Debian shipped it within two weeks (TuxCare). Red Hat’s fixed kernels for RHEL 8, 9 and 10 came on 1 November. On 2 November, Ubuntu’s current releases still showed the fix pending, and its 16.04 to 20.04 releases had none (Webhosting.Today). A patched kernel protects nothing until the server is running it, which usually means a reboot. Red Hat offered an interim mitigation in the meantime (L’Usine Digitale).
53 min
for the Linux exploit to reach root, by Anthropic’s account
27 days
from the upstream fix to the first Red Hat kernels
3 months
ENISA’s delay in gaining access to Mythos 5, by Techzine’s count
The exploit takes 53 minutes. Red Hat’s fixed kernels took 27 days.
Exposure is also wider than most operators think. Since Go 1.24, Go programs accept multipath TCP on Linux listeners by default, so a service can be in scope without anyone choosing it. The Go Security Team calls switching it off program by program “a fragile mitigation” and warns that systems without such listeners may face similar attacks (Go Security Team via oss-security).
Keep the lab result in proportion, too. Anthropic gave no success rates, costs or human hours per chain (ToKnow.ai, citing Black Duck’s Andrew Bolster in Dark Reading). The capability may be less than the headline. The patch gap is not.
Then there is the promise of defence. The claim that AI gives defenders the edge assumes defenders hold the AI. Most do not. They hold a licence to it. Anthropic’s Cyber Verification Program has three tiers, and applications for the most sensitive, Specialized Access, are reviewed “in collaboration with the US government” (Claude Help Center).
The geopolitical frame
A licence can be suspended. On 12 June, a US Commerce Department directive barred foreign nationals from Mythos 5 and Fable 5, and Anthropic pulled both models for everyone (EisnerAmper). The restriction was lifted on 30 June, but Mythos 5 stayed limited to approved US organisations (Techzine).
ENISA, the EU’s cybersecurity agency, was in talks with Anthropic by late May. By September it was testing Mythos 5, for defensive use only, and still without the latest version (Techzine). As early as June, The Next Web reported that the access standoff had reinforced European concerns about dependency on American AI infrastructure (The Next Web).
This is not a charge against any one government. Any state hosting such a model would want the same lever. The point is where the lever sits. Whoever decides which defenders see a flaw first now shapes the terrain for everyone downstream, and middle powers in Europe, the Gulf, Africa and Southeast Asia sit downstream.
For governments, for boards
For governments
Treat access to frontier defensive AI as a sovereign capability, not a subscription. Plan for it being switched off, and fund the national teams that can find and patch without it.
For boards
You cannot buy the model’s speed. You can own yours: the days between a vendor’s fix and a rebooted server is the number to measure and fund.
Monday morning
- Find the kernels you actually run. List every internet-facing Linux server by distribution and kernel version, and check each against your vendor’s status for CVE-2026-98432 today.
- Count days, not patches. Measure the time from a vendor’s kernel fix to a rebooted production server. If it runs past a week for exposed systems, that is the risk to fund.
- Write the dependency down. List the AI and security services your defence relies on, whose rules govern each, and what you do if one is switched off tomorrow.
About the desk
Elias Marek is the pen name of Beyond’s threat-analysis desk: practitioners with two decades across offensive security, government, finance and critical infrastructure. The Contrarian Desk is opinion. Where it names a state, it says who named it first.
All columns