Claude Finds Critical Xen VM-Escape Flaws

The Xen Project on Nov. 3 disclosed two hypervisor flaws that let a malicious virtual machine read and write the memory of every other guest on the same host, including the privileged control domain, Dom0. Its advisory, XSA-523, credits Anthropic with finding the bugs using its Claude AI model.

Key takeaways

• XSA-523 covers CVE-2026-102703 and CVE-2026-102704 in Xen's grant copy code. Every Xen release from 4.6 onward is affected.
• The Xen Project says there is no known mitigation. Patching and rebooting is the only fix.
• Anthropic found the bugs with Claude, Stephan Lipp of Ada Logics validated them, and CodeAnt AI later reported the same issue independently.

What the Xen grant copy flaw does

Grant copy is the mechanism Xen guests use to move data between each other's memory, for example between a VM and the driver domain that handles its disk or network. When guests batch several copy operations on adjacent memory ranges, Xen reuses earlier validation work to save time.

According to the XSA-523 advisory, the rules for when to re-check that cached data "were not correct in some cases." In CVE-2026-102703, frame numbers and grant references could be mixed up. In CVE-2026-102704, a check meant to limit copying by frame number to the caller's own memory was misplaced.

The result, in the advisory's words: "A malicious guest can read and write arbitrary memory, belonging to other domains, including Dom0." Xen 4.5 and earlier are not vulnerable.

Who is affected and how to patch

Xen powers several open-source virtualization platforms. Vates, which maintains XCP-ng, rated the impact "Critical" in advisory VSA-2026-055 and shipped the fixed package xen-4.17.7-4.2.xcpng8.3 on Nov. 3. A CVSS score was listed as "not available yet."

"A single compromised guest can break out of its isolation and take over the whole host," the XCP-ng team wrote in its Nov. 3 update notes, advising users to update immediately. Host reboots are required.

Qubes OS, which isolates apps in separate Xen VMs, said in bulletin QSB-121 that all supported releases and configurations are affected. Qubes 4.3 users get Xen packages version 4.19.6-3 in dom0 and must restart afterward. Users of Anti Evil Maid must also reseal their passphrase because measured-boot values change.

The advisory does not mention any attacks in the wild or say what access an attacker needs inside the VM, The Hacker News noted. As of Nov. 4, Debian's security tracker still listed Xen as vulnerable in its bookworm, trixie and forky releases.

Context: AI models as bug hunters

The credit line is unusual for a hypervisor advisory: "This issue was discovered by Anthropic using Claude, then validated by Stephan Lipp of Ada Logics." It came a day before OpenAI said its agents produced exploits for 948 Linux kernel bugs, while attackers adopt similar tools; we recently covered how attackers ran agents that rebuilt their malware until scanners stopped catching it.

A second, independent report of the same bug by the CodeAnt AI Security Research Team suggests that automated tools are now reaching the same deep flaws in parallel.

What's next

Qubes expects the fixed packages to move from testing to stable over the next two weeks. Operators running older Xen releases face a harder choice: the advisory ships patches only for Xen 4.17 and later, and security support for Xen 4.16 ended on Dec. 2, 2024.

FAQ

Is there a workaround for XSA-523?

No. The Xen Project and Vates both say there is no known mitigation other than applying the patches and rebooting.

Does this affect cloud VMs I rent?

Only providers running unpatched Xen 4.6 or later are exposed. Customers should check their provider's security notices, since the fix happens on the host, not inside the guest.

Did Claude find the bug on its own?

The advisory says Anthropic discovered it using Claude and that a human researcher at Ada Logics validated it before disclosure.

References

• XSA-523 - Xen Security Advisories — Xen Project (Nov. 3, 2026)
• VSA-2026-055: arbitrary read/write via grant copy (CVE-2026-102703, CVE-2026-102704 / XSA-523) — Vates (Nov. 3, 2026)
• November 2026 Security and Maintenance Updates #1 for XCP-ng 8.3 LTS — XCP-ng (Nov. 3, 2026)
• QSB-121: Arbitrary read/write via grant copy (XSA-523) — Qubes OS (Nov. 3, 2026)
• Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory — The Hacker News (Nov. 4, 2026)