Claude finds two critical Xen flaws that let a rogue VM take over the whole server

What's going on

On Tuesday, November 3, 2026, at 12:00 UTC, the Xen Project published version 2 of security advisory XSA-523. Xen is one of the oldest open-source hypervisors. A hypervisor is the software that runs many virtual machines (VMs) side by side on a single physical server and keeps them isolated from one another, a bit like apartments in a building. The advisory describes two critical flaws, tracked as CVE-2026-102703 and CVE-2026-102704. They let a malicious VM (a "guest" in Xen terminology) break through that isolation and access the memory of other VMs on the same server.

The advisory states that the flaws were "discovered by Anthropic using Claude." Stephan Lipp of Ada Logics, a firm that runs security audits of open-source software, confirmed them. The Indonesian outlet Industry.co.id was among those reporting on the issue.

What goes wrong under the hood

In Xen, individual VMs are called "domains." To let them exchange data in a controlled way, Xen provides a mechanism called grant copy. One domain issues a kind of permission slip, the grant reference, and Xen copies the data between domains. To speed things up, Xen caches details it has already validated when several copy operations in a row touch the same memory page. That way, it doesn't have to re-check everything each time.

That's exactly where the bug lies: in some cases, the conditions that decide when this cached information must be re-validated are wrong. This results in two flaws:

A frame number identifies a specific block of physical RAM. If a frame number gets mixed up with a permission slip, a VM can address memory that doesn't belong to it.

Why Dom0 is the worst case

Dom0 is the privileged domain on a Xen server. It manages all the other VMs and controls the hardware, making it the building superintendent with the master key. According to the report, anyone who can write to Dom0's memory can in practice take over the entire host, along with every VM running on it. Since the flaws were introduced back in version 4.6, they apparently sat in the code for many years without anyone noticing.

Who's affected and what admins should do

The risk is highest for providers that run VMs from different customers on the same Xen servers, such as VPS and cloud providers. There, a malicious customer could theoretically read or tamper with other customers' data. Administrators should also keep an eye on Xen-based products such as XCP-ng, XenServer, and the security-focused operating system Qubes OS, and follow their vendors' updates.

Practical steps, according to the report:

• Check which Xen version you're running. If it's 4.6 or newer, the server is vulnerable.
• Apply the matching XSA-523 patch for your release branch, or first update to the latest state of the stable branch.
• Watch security announcements from XCP-ng, XenServer, and Linux distributions for patched packages.
• If you rent a VPS, ask your provider whether its hosts run on Xen and have already been patched.

According to the advisory, there is no temporary workaround.

Two teams, one bug

Besides Anthropic, the CodeAnt AI Security Research team reported the same flaws independently. Two groups finding the same bug is no coincidence: according to the report, many teams now use AI tools to hunt for bugs, defenders and potentially attackers alike. The report doesn't say which Claude model Anthropic used or how much human work went into the find.

The bigger picture

This case adds to a growing list of serious vulnerabilities in critical software found with the help of AI. Two things stand out here. First, this isn't some fringe project but a mature hypervisor that has been scrutinized for decades and runs in countless data centers. Second, the bug hits the most important security boundary a hypervisor has: the separation between VMs belonging to different customers.

For defenders, that's good news, since the flaw was reported and fixed rather than exploited. The flip side: if AI can reliably find bugs like this, attackers have access to the same tool. The fact that two teams discovered the flaw independently shows how quickly the window closes in which only defenders know about a find. For anyone running Xen servers, the situation is clear: there's no mitigation, so patch now.