16 million computers affected: Claude reveals a 9-year-old Linux vulnerability

A new vulnerability has been discovered in the Linux code. Named “RefluXFS,” the flaw is located in the kernel of the operating system.The vulnerability was uncovered by the Qualys Threat Research Unit with the help of Claude Mythos, Anthropic’s AI model built to track down security issues.

The Qualys Threat Research Unit (TRU) has disclosed RefluXFS, a critical race condition in the Linux kernel’s XFS filesystem (v4.11+) affecting about 16.4 million enterprise systems worldwide including RHEL, Amazon Linux, and Fedora. It’s been present since kernel version 4.11… pic.twitter.com/mNsyKCHBYm

— Qualys (@qualys) July 22, 2026

The California-based company Qualys is indeed one of the member organizations ofProject Glasswing, which brings together Anthropic’s carefully vetted partners, who are authorized to use Mythos. In just a few weeks, the partners selected by Anthropic, including Amazon, Apple, Broadcom, Cisco, CrowdStrike, Google, Linux Foundation, Microsoft, and NVIDIA, discovered more than 10,000 vulnerabilities in their systems with the help of Claude Mythos.

Also read: Thank you, AI—Linux has patched more than 400 security vulnerabilities in 24 hours!

A vulnerability at the core of Linux

As part of the experiments encouraged by Anthropic, Qualys researchers asked Claude Mythos Preview to hunt down specific vulnerabilities known as “Dirty COW” in Linux’s operation. This type of flaw, which has been present in the kernel for 20 years, allows an attacker to modify files that are supposed to be read-only, opening the door to privilege escalation.

“We integrated Claude Mythos Preview into our manual audit workflow to accelerate our research while maintaining strict human oversight,” explains the Qualys Threat Research Unit.

Through its investigations, the AI managed to uncover a bug in the way Linux copies and protects files with XFS, a journaling system that organizes files and directories on a disk or partition. Claude Mythos did not limit itself to discovering the flaw. The AI generated a method for exploiting the vulnerability. This attack code demonstrates that an ordinary user could exploit the bug to silently overwrite protected files. This could enable them to gain full, in-depth access to the targeted computer.

More than 16 million vulnerable computers

Qualys researchers confirmed the validity of Mythos’s findings. They reproduced the attack scenario in Linux environments and analyzed the relevant kernel code. The experts found that the tactic for exploiting the RefluXFS flaw did indeed work. According to Qualys estimates, more than 16.4 million systems may potentially be affected worldwide. In fact, every Linux system using XFS is affected.This vulnerability has been present “since kernel version 4.11”, released in 2017.

The researchers then alerted the XFS maintainers and the Linux Kernel Security Team, the group of experienced developers responsible for reviewing vulnerability reports. Several key figures in the ecosystem, including the founder Linus Torvalds, then took part in analyzing the flaw and designing a fix. An update containing a patch was quickly deployed by the Linux teams, which were already overwhelmed by the workload.

“We consider this vulnerability an absolute emergency”, the researchers stressed.

This is not the first time AI has uncovered a vulnerability in the Linux codebase. Over the past few months, generative AI has helped identify numerous vulnerabilities that have lain dormant for sometimes nearly a decade, such as Copy Fail, a vulnerability dating back more than nine years.

“The lesson to be learned is not that AI can be used to exploit security flaws, but rather that, when combined with the human expertise of specialists, it enables security teams to identify and fix critical vulnerabilities before attackers exploit them”, Qualys said.

👉🏻 Follow tech news in real time: add 01net to your Google feeds and subscribe to our WhatsApp channel.