Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH036

How do the public signals about CVE-2026-98432 move, from its fix on 15 October 2026 through Anthropic's account of an exploit on 27 October, and where has the fix landed?

In short. Anthropic said on 27 October that its model wrote a working exploit for CVE-2026-98432, a serious Linux kernel flaw fixed on 15 October. We watch the public signals defenders rely on: CISA's list of exploited flaws, the EPSS exploit-prediction score, how the official record is scored and enriched, and fixes from Debian, Ubuntu, Red Hat and SUSE. Reads are twice a week, until 13 January 2027 or 14 days after a CISA listing. The exploit and the post are Anthropic's, and Lighthouse runs on Anthropic's models.

Latest read, 9 November 2026 (unreviewed working note): Monday's read of how the Linux flaw behind one of Anthropic's attack chains, CVE-2026-98432, is scored and fixed. CISA's catalogue still does not list it, its EPSS score held at 0.76 per cent through 8 November, and NVD moved it to "Awaiting Analysis" with no score of its own and no CISA container. Ubuntu now has a fix released for one release and fixes pending for every other affected one, including the three oldest, which had none on 5 November. Read the note

No write-up yet studies/LH036/brief.md

Checkpoints

The working notes written at each read, newest first. They are unreviewed: a finding reaches a piece only after review.

From studies/LH036/ in the repository, last changed 9 November 2026.