Hidden linux kernel flaw discovered by ai – a 23-year security risk

A chilling revelation has emerged from the depths of the Linux kernel: a persistent, exploitable vulnerability, lurking undetected for over two decades, was unearthed by artificial intelligence.

A 23-year-old backdoor uncovered

Researchers at Anthropic, utilizing their Claude Code AI model, identified a heap buffer overflow within the Network File System (NFS) controller – a critical component of the operating system. This flaw, initially flagged in March 2003, remained dormant until now, highlighting a shocking lapse in vigilance and a potential nightmare scenario for cybersecurity.

The discovery, detailed during the Unprompted 2026 security conference, involved Claude Code's ability to analyze source code with alarming precision. Nicholas Carlini, an Anthropic researcher, simply posed the question: “Where are the security vulnerabilities?” – and the AI swiftly returned a list of critical weaknesses, including this long-forgotten exploit.

Specifically, the vulnerability lies in the way the kernel writes data – over 1,000 bytes into a memory region designed to handle only 112. This creates a pathway for remote attackers to inject malicious code, steal sensitive data, or engage in sophisticated espionage operations. The fact that it’s been concealed for so long is deeply unsettling.

While the immediate impact remains unclear – whether it’s been actively exploited – the implications are profound. Experts suggest this could represent an early stage in a broader trend: AI’s increasingly sophisticated ability to identify latent vulnerabilities in fundamental system software, potentially exposing Windows and macOS to similar risks.

“I’ve never encountered one of these before,” Carlini stated. “This is incredibly difficult to do. With these language models, I have a lot.” The speed and accuracy with which Claude Code pinpointed the flaw is nothing short of remarkable, revealing a level of detail that human engineers had evidently missed for over two decades. The process itself – a simple script to traverse files and query the AI – underscores the transformative potential of AI in bolstering software security.

However, a note of caution persists. The team acknowledges that they’ve only scratched the surface. Hundreds of potential vulnerabilities have been identified, and their validity remains unverified – a daunting task given the scale of the undertaking. The potential for