Critical UEFI Boot Flaw Affects Most Servers; Anthropic Disputes Scope of AI-Led Intrusion

Widespread UEFI Vulnerability Discovered

A critical buffer overflow vulnerability, identified as CVE-2026-97631, has been found in TianoCore EDK II. This open-source code is widely adopted by server vendors and data centers through firmware suppliers such as AMI, Insyde, and Phoenix, meaning the flaw impacts the majority of servers worldwide. The vulnerability has existed for 16 years.

Exploitation and Impact

An attacker with local network access can exploit this flaw by sending an oversized ICMP error message to a machine during network boot (PXE). This can either hang the boot process or, if the target's firmware build is known, allow the attacker to run code at the highest privilege level before security measures like Secure Boot are active. Only machines configured for network boot are exposed to this vulnerability. The flaw was discovered by researchers from Anthropic and Google, and its public disclosure occurred earlier than planned after AMI released a code fix.

Anthropic Responds to Security Breach Claims

Cybersecurity startup Cathedral, founded by former DOGE staffers, reported that its AI agents successfully breached Anthropic's internal systems within 12 hours. Cathedral claimed to have accessed sensitive data, including meeting transcripts, salary and job offer information, and Slack discussions concerning Anthropic's advanced models, by exploiting weaknesses in third-party business software. Anthropic, which received these findings via its bug bounty program, has disputed the extent of the intrusion, stating that only a limited set of sales, HR, and IT systems were affected.