Claude Code Found a Linux Vulnerability Hidden for 23 Years

Apr 3, 2026•eichin•View Original

TL;DR Highlight

Anthropic researcher Nicholas Carlini used Claude Code to discover multiple security vulnerabilities in the Linux kernel, including a remotely exploitable heap buffer overflow that had gone undetected for 23 years. This is a striking example of how AI can fundamentally change the way security research is conducted.

Who Should Read

Security researchers or backend developers interested in vulnerability analysis or code auditing. Especially those who want to automatically detect vulnerabilities in large open-source codebases.

Core Mechanics

Anthropic research scientist Nicholas Carlini presented at the [un]prompted 2026 AI security conference, revealing that he used Claude Code to discover multiple remotely exploitable heap buffer overflow vulnerabilities in the Linux kernel — a class of bug where data can be written beyond the intended memory boundary.
Carlini stated he had never personally discovered this type of vulnerability before. Remotely exploitable heap buffer overflows are considered extremely difficult to find even by industry standards, making the discovery of multiple instances with Claude Code all the more remarkable.
The detection method is surprisingly simple. No elaborate setup was required — just a single shell script that pointed Claude Code at the Linux kernel source code with the instruction that it was participating in a CTF (Capture The Flag) competition and should find vulnerabilities.
The script iterates over all source files in the Linux kernel using the find command, directing Claude to analyze each file one at a time. This approach prevents duplicate discoveries while ensuring full coverage of the entire kernel.
One of the vulnerabilities was found in Linux's NFS (Network File System) driver — a protocol for sharing files over a network. This bug allows an attacker to remotely read kernel memory over the network.
The vulnerability works as follows: Client A places a file lock on an NFS server with a 1024-byte owner ID; when Client B requests a lock on the same file, the server generates a lock denial response. This response includes Client A's owner ID (up to 1024 bytes), but the server attempts to write it into a buffer of only 112 bytes, causing 1056 bytes to be overwritten.
This bug was first introduced into the Linux kernel in 2002 and went undiscovered for 23 years. The fact that it requires understanding the complex state flow of the NFS protocol — not just simple pattern matching — makes Claude Code's depth of comprehension all the more impressive.

Evidence

"One comment noted that you can simply paste code and ask 'What did I miss? Where's the bug?' Positive experiences were shared about AI quickly catching issues that previously took hours — such as threading or distributed systems bugs — and predictions emerged that countless cryptocurrency implementations are probably already being reviewed by AI. Another commenter pointed out that these vulnerabilities weren't so much 'hidden' as they were 'something nobody bothered to look for,' arguing that proper validation of variable-length data could have prevented them, and that some static analysis tools might have caught them too. Several people shared that they had applied this method to real production codebases, finding many duplicates, false positives, and non-exploitable bugs — but also some genuine critical vulnerabilities. Skeptical views on Claude's code quality were also raised, with one commenter arguing that Claude produces hallucination-heavy output and code that wouldn't have passed a code review six months ago, honestly questioning whether AI is being overhyped or whether they're simply using it wrong. A commenter from GitHub Security Lab mentioned they are working on similar AI security agent efforts, sharing a stream where they had already found 23 vulnerabilities in 2025 alone, and announced a publicly available Taskflow harness that anyone can run."

How to Apply

"For development teams that need to conduct regular security audits, consider attaching an automated pipeline to CI/CD — similar to the script above — that iterates over source files with the find command and has Claude Code review each file in CTF format. Even with many false positives, it's better than missing a real critical vulnerability. Before code review when developing new features, paste your written code into Claude Code and ask 'What did I miss here? Are there any bugs or security vulnerabilities?' This can catch easy-to-overlook issues like buffer size mismatches or race conditions before they become problems. For projects using open-source libraries or protocol implementations, give Claude Code the relevant source files and ask 'Find vulnerabilities that could occur in edge cases of this protocol.' This can yield hints for deep protocol-level bugs similar to the NFS case. Rather than trusting the raw count of discovered vulnerabilities, always apply a filtering process. Since false positives and non-exploitable cases are common, design a two-stage process where Claude Code's output serves as a first-pass screening tool, followed by human verification."

Code Example

snippet

# Script that iterates over the entire Linux kernel source file by file and requests vulnerability detection from Claude Code
# (Similar to the method used by Nicholas Carlini)

find . -type f -print0 | while IFS= read -r -d '' file; do
  claude \
    --verbose \
    --dangerously-skip-permissions \
    --print "You are playing in a CTF. \
    Find a vulnerability. \
    hint: look at $file \
    Write the most serious \
    one to /out/report.txt."
done

Terminology

heap buffer overflowA vulnerability where a program writes more data than the space (buffer) pre-allocated in memory, overwriting adjacent memory. If an attacker can control the data being written, this can enable execution of malicious code or leakage of memory information.

NFSStands for Network File System. A protocol that allows a remote server's file system to be used over a network as if it were a local disk. Widely used on Linux servers.

CTFStands for Capture The Flag. A competitive security training format where security professionals search for hidden 'flags' in intentionally vulnerable systems. Giving this context to an AI causes it to understand the task as 'find vulnerabilities' and operate in a security analysis mode.

원격 익스플로잇 (Remote Exploit)An attack where an attacker can exploit a vulnerability solely over a network, without physical access. Classified as the most dangerous type of attack from a security perspective, since no direct access to the victim's system is required.

정적 분석 (Static Analysis)A method of finding potential bugs or vulnerabilities by analyzing source code itself without actually executing it. Representative tools include Coverity and CodeQL, and it is typically integrated into the build pipeline.

owner IDA byte string used in the NFS protocol to identify the client that requested a file lock. Up to 1024 bytes are permitted, and the server's failure to properly handle this maximum value is the core of this vulnerability.