Xen fixes a flaw that Anthropic found with Claude, which let a guest virtual machine read and write other machines' memory

The Xen Project, which makes the open-source hypervisor used under many cloud and virtualisation stacks, published security advisory XSA-523, “arbitrary read/write via grant copy”, on 3 November.

Xen caches validated data to speed up batches of grant-copy operations on nearby memory. In some cases the conditions for re-checking that cached data were wrong, which caused two bugs, CVE-2026-102703 and CVE-2026-102704. The advisory's impact statement reads: “A malicious guest can read and write arbitrary memory, belonging to other domains, including Dom0.” Dom0 is the privileged control domain. All Xen versions from 4.6 onwards are affected; the advisory lists no mitigation, and patches are out for the 4.17, 4.18 and 4.19 branches and for xen-unstable.

The credits section reads: “This issue was discovered by Anthropic using Claude, then validated by Stephan Lipp of Ada Logics.” It adds that the issue was independently reported by the CodeAnt AI Security Research Team.

A hypervisor isolation bug is the kind of flaw that can let one cloud tenant reach another. The advisory adds to a run of infrastructure flaws credited to AI models this autumn, including Anthropic's exploit chains for Chrome and Linux and OpenAI's 948 Linux kernel flaws. The Switchboard noted it as a one-line item on 5 November; this is the full story, in the catch-up lane.

• Confirmed XSA-523 (CVE-2026-102703, CVE-2026-102704), public on 3 November, lets a malicious guest read and write the memory of other domains, including Dom0. Xen Project, XSA-523
• Confirmed Xen 4.6 onwards is affected, no mitigation is listed, and patches are available for 4.17 to 4.19 and xen-unstable. Xen Project, XSA-523
• Confirmed The advisory credits Anthropic using Claude with the discovery, validated by Stephan Lipp of Ada Logics, and says the CodeAnt AI Security Research Team reported it independently. Xen Project, XSA-523