Ai unearths 23-year-old linux kernel flaw

Anthropic’s code generation AI, Claude Code, has moved beyond generating potentially malicious code—it’s now finding vulnerabilities that have eluded human eyes for decades. The revelation, presented at the [unprompted] 2026 security conference, underscores a significant shift in cybersecurity, potentially rendering years of painstaking manual code review obsolete.

A heap buffer overflow lurking in plain sight

The discovery centers around a heap buffer overflow within the Linux kernel’s Network File System (NFS) driver—a flaw that has existed since March 2003, predating the widespread adoption of Git. Nicholas Carlini, a researcher at Anthropic, demonstrated the AI’s ability to identify this remote exploit, a feat he described as “very, very, very difficult” for humans. The AI, tasked with simply identifying security vulnerabilities, flagged the overflow, where the kernel writes over 1,000 bytes into a space allocated for only 112, effectively creating a controllable memory overwrite – a prime avenue for malware injection, data theft, or espionage.

While the immediate threat of exploitation remains unclear, the sheer duration this flaw has remained undetected is deeply concerning. For years, experienced engineers meticulously reviewed code, yet this critical vulnerability slipped through the cracks. The implications are clear: reliance on manual code auditing may be reaching its limits.

Beyond code generation: ai as a security auditor

What makes this discovery particularly striking is the simplicity of the AI’s approach. Carlini didn't require bespoke software or specialized AI guidance. A straightforward prompt—