TLDR Tech / InfoSec
MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
Researchers at Calif gave Claude a FreeBSD security advisory (CVE-2026-4747) and, roughly 4 hours of active AI work later, had two working remote kernel exploits which both succeeded on the first try. The bug lives in FreeBSD's RPCSEC_GSS NFS implementation: a stack overflow in an int32_t[] buffer with no canary protection and no KASLR, so kernel addresses are fixed. Claude built the full chain, lab setup, multi-packet shellcode delivery across 15 NFS rounds, ROP construction, clean thread exit via kthread_exit(), De Bruijn offset correction, kernel-to-userland process spawning, and a stale debug register fix which ended up producing a reverse shell as uid=0 (root user).
Read the full story