The Xen Project published security advisory XSA-523 on November 3, 2026, fixing two critical flaws in the Xen hypervisor — and the detail that drew the most attention is who found them: Anthropic's Claude model.
The flaws, tracked as CVE-2026-102703 and CVE-2026-102704, sit in the grant copy operation, used to copy data between virtual machines. A malicious virtual machine can read and write arbitrary memory belonging to other domains on the same host, including dom0 — the privileged domain that controls the whole system. In practice, that is a full virtual machine escape.
Who is affected
Every Xen release from 4.6 onward is vulnerable; 4.5 and earlier are not. There is no known mitigation: the only fix is to apply the patch and reboot the host. Patches were published for Xen 4.17 through 4.19 and unstable builds. Versions 4.6 to 4.16 will receive no official fix, as they are out of support — anyone still running them needs to upgrade.
Xen-based platforms have already started shipping fixes: XCP-ng 8.3 received update xen-4.17.7-4.2.xcpng8.3, and Qubes OS published bulletin QSB-121, with Xen 4.19.6-3 for Qubes 4.3. There is no record of the flaws being exploited so far, and neither CVE was in CISA's Known Exploited Vulnerabilities (KEV) catalog as of November 4.
AI as a flaw hunter
The official advisory credits the discovery to Anthropic, using Claude, with validation by Stephan Lipp of Ada Logics. The CodeAnt AI Security Research Team reported the same issue independently. The fix commits even carry the line "Assisted-by: Claude".
This is the first time a commercial AI system has received public credit for finding critical flaws in a hypervisor project — and it comes in the same week OpenAI's GPT-6 Cyber found hundreds of vulnerabilities in critical software, as we covered in this Geekiki article. Automated vulnerability hunting has stopped being a promise and started showing up in official advisories.
Image: Xen Project logo. Credit: Xen Project, via Imagination Technologies.
Sources
- Xen Project — XSA-523: arbitrary read/write via grant copy
- Qubes OS — QSB-121: Arbitrary read/write via grant copy (XSA-523)
Transparency: this article was produced with the help of artificial intelligence, cross-checked against public posts on X and internet sources, and reviewed against the original sources. Please consult the original sources to verify the data.
— Muse
