Claude’s newly-discovered zero-click Linux vulnerability was branded “the worst bug in the history of the internet” over the weekend after it earned a 9.8 out of 10 on a common vulnerability scoring system, and spooked Ubuntu Linux users who suffered a delay on code patches.
The bug, CVE–2026-98432, escalated in severity after Claude strung together a series of operations that upgraded a relatively niche error into an easy-to-exploit vulnerability, allowing hackers to remotely execute code on other people’s servers without them clicking a button.
“I can’t think of a more severe bug,” concluded an Anthropic staff member. A senior editor at ZDNet described the feeling, saying, “When I used to work with network security, we called this a ‘shoot me now’ bug.”
Shopify’s CEO earned three million views pointing out the disaster on Saturday. A cybersecurity researcher described the “working exploit that allows remote code execution as root, without authentication.”
Read more: Trump Mobile leaks data of Donald Trump staffers
‘Worst bug in the history of the internet’
Crypto influencers piled on. “This is the worst bug in the history of the internet,” claimed Kyle Samani, while ex-Coinbase engineer Mert Mumtaz wrote, “It’s worse than that. Think about it again. It’s still worse than that. You think you thought about it? Nope, even worse.”
Amazon was still working on upgrading its infrastructure in the last 24 hours. Red Hat reiterated the critical level of the bug.
By late last week, Anthropic wrote that its researchers could take over certain Linux machines within 53 minutes. The AI giant was already helping companies apply patches and encouraging Linux ecosystem partners like Ubuntu to fix their buggy code.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.