Claude Code cracks FreeBSD within four hours

Security researcher Nicholas Carlini, supported by Anthropic’s AI model Claude, identified a vulnerability in the FreeBSD operating system and exploited it within four hours. Claude was also capable of creating a working exploit. The vulnerability has been reported as CVE-2026-4747.

The FreeBSD operating system serves as a foundation for a wide variety of products across many technical sectors. Companies such as IBM, Nokia, Juniper Networks, and NetApp use the system to develop their infrastructures. Parts of Apple's macOS are also based on components from FreeBSD.

In the entertainment industry, elements of FreeBSD can be found in the operating systems of the PlayStation 3, PlayStation 4, and the Nintendo Switch. Additionally, large-scale, network-oriented services like Netflix and WhatsApp rely on the architecture of this system. The vulnerability is located in the RPCSEC_GSS module, which is responsible for Kerberos authentication on NFS servers.

The exploitation utilized a so-called stack buffer overflow. In this process, data is written into a memory area that is not large enough, which can cause adjacent memory areas to be overwritten. Information regarding an upcoming model from Anthropic, named "Mythos," suggests that such exploitations could take place in even less time.

The speed at which vulnerabilities are identified and directly converted into functional exploits is changing the dynamics of IT security. While traditional patch cycles—the period between a security advisory and the installation of an update—can often take weeks in corporate environments, automated exploitation is already operating in the range of hours.