Xen credits Claude for critical grant-copy VM-escape flaws

The Xen Project disclosed two critical grant-copy flaws on November 3 that let a malicious guest VM read and write the memory of any other VM on the same host, including dom0, and credited Anthropic's Claude AI model with finding them. The advisory, XSA-523, covers CVE-2026-102703 and CVE-2026-102704 and, The Hacker News reported, affects every Xen release from 4.6 onward; 4.5 and earlier are not vulnerable.

The bug sits in Xen's grant copy operation, the mechanism VMs use to pass data between themselves. Batches of copies on adjacent ranges in the same page let Xen cache validated frame numbers and grant references for performance. The conditions on when to revalidate were wrong in some cases, allowing frame numbers and grant references to be wrongly mixed up and a guest to reach memory it should not touch.

"Anthropic identified these flaws using its Claude AI model," the advisory credits read, after which "Stephan Lipp of Ada Logics subsequently validated the findings," and the CodeAnt AI Security Research Team independently reported the same issues. The patch commit carries a trailing line reading "Assisted-by: Claude."

XCP-ng, which packages Xen for its own distribution, put the stakes starkly in its update notes: "a single compromised guest can break out of its isolation and take over the whole host." Fixes have shipped for XCP-ng 8.3 as xen-4.17.7-4.2.xcpng8.3 with a host reboot required, and for Qubes OS 4.3 as Xen 4.19.6-3 in dom0, which also needs a dom0 restart and forces Anti Evil Maid users to reseal passphrases. Xen 4.6 through 4.16 have no patches; 4.16 support ended December 2024.

The credit continues a visible stretch for Anthropic's security work on our tracker, which has logged 360 Anthropic items in the last 90 days, including the same-day release of FlashProve and a filing in which the lab tells IPO investors Claude helps design its chips.