Xen credits Claude for critical grant-copy VM-escape flaws

Claude earned an 'Assisted-by' commit credit in Xen, the first public critical-CVE credit for a frontier AI model in virtualization infrastructure.

Ada Logics' Stephan Lipp validated Claude's findings, and CodeAnt AI Security Research Team independently rediscovered both flaws.

Patches exist only for Xen 4.17.x through 4.19.x; every version from 4.6 through 4.16 carries the cross-tenant escape risk with no official remediation path.

The Xen Project disclosed two critical grant-copy flaws on November 3 that let a malicious guest VM read and write the memory of any other VM on the same host, including dom0, and credited Anthropic's Claude AI model with finding them. The advisory, XSA-523, covers CVE-2026-102703 and CVE-2026-102704 and, The Hacker News reported , affects every Xen release from 4.6 onward; 4.5 and earlier are not vulnerable.

The bug sits in Xen's grant copy operation, the mechanism VMs use to pass data between themselves. Batches of copies on adjacent ranges in the same page let Xen cache validated frame numbers and grant references for performance. The conditions on when to revalidate were wrong in some cases, allowing frame numbers and grant references to be wrongly mixed up and a guest to reach memory it should not touch.

"Anthropic identified these flaws using its Claude AI model," the advisory credits read, after which "Stephan Lipp of Ada Logics subsequently validated the findings," and the CodeAnt AI Security Research Team independently reported the same issues. The patch commit carries a trailing line reading "Assisted-by: Claude."

XCP-ng, which packages Xen for its own distribution, put the stakes starkly in its update notes: "a single compromised guest can break out of its isolation and take over the whole host." Fixes have shipped for XCP-ng 8.3 as xen-4.17.7-4.2.xcpng8.3 with a host reboot required, and for Qubes OS 4.3 as Xen 4.19.6-3 in dom0, which also needs a dom0 restart and forces Anti Evil Maid users to reseal passphrases. Xen 4.6 through 4.16 have no patches; 4.16 support ended December 2024.

The credit continues a visible stretch for Anthropic's security work on our tracker, which has logged 360 Anthropic items in the last 90 days, including the same-day release of FlashProve and a filing in which the lab tells IPO investors Claude helps design its chips .

What others are reporting

Coverage cluster as of 2h after publish

Xen Project Read → First-party advisory from the Xen Project; defines the patched version range (4.17.x-4.19.x) and explicitly confirms 4.6-4.16 receives no patch. A malicious guest can read and write arbitrary memory, belonging to other domains, including Dom0.

First-party advisory from the Xen Project; defines the patched version range (4.17.x-4.19.x) and explicitly confirms 4.6-4.16 receives no patch.

A malicious guest can read and write arbitrary memory, belonging to other domains, including Dom0.

Qubes OS Project Read → First-party downstream advisory confirming all supported Qubes releases are affected; delivers PGP-signed patch instructions directly to end users. A malicious qube can read and write arbitrary memory belonging to other qubes, including dom0.

First-party downstream advisory confirming all supported Qubes releases are affected; delivers PGP-signed patch instructions directly to end users.

A malicious qube can read and write arbitrary memory belonging to other qubes, including dom0.

Ostorlab Read → Most technically deep coverage: traces the flaw to specific code paths in grant_table.c, provides step-by-step exploitation scenarios and visual attack flowcharts. a malicious guest can read and write arbitrary memory belonging to other domains, including Dom0

Most technically deep coverage: traces the flaw to specific code paths in grant_table.c, provides step-by-step exploitation scenarios and visual attack flowcharts.

a malicious guest can read and write arbitrary memory belonging to other domains, including Dom0

freenode Read → Operational framing aimed at infrastructure teams; pairs XSA-523 remediation guidance with concurrent ZooKeeper vulnerabilities as urgent same-day patching. A malicious guest can read and write arbitrary memory belonging to other domains, including Dom0.

Operational framing aimed at infrastructure teams; pairs XSA-523 remediation guidance with concurrent ZooKeeper vulnerabilities as urgent same-day patching.

A malicious guest can read and write arbitrary memory belonging to other domains, including Dom0.

Mallory Read → Threat intelligence view with exposure mapping and timeline from embargo through patch; tracks whether threat actors are actively exploiting the CVEs. a malicious qube could access or modify memory belonging to other qubes or dom0

Threat intelligence view with exposure mapping and timeline from embargo through patch; tracks whether threat actors are actively exploiting the CVEs.

a malicious qube could access or modify memory belonging to other qubes or dom0

Originally reported by thehackernews.com

Original headline: Xen Discloses Two Critical Grant-Copy CVEs Found by Anthropic's Claude, All 4.6+ Versions Vulnerable