Anthropic’s unreleased Claude chained flaws into working Chrome, Safari, Android, Windows and Linux exploits

Anthropic’s Frontier Red Team disclosed Oct. 27, 2026, in a research post that an unreleased internal research model identified vulnerabilities in Chrome, Safari, Android, Windows and Linux and combined them into functioning proof-of-concept exploits.

The company built the exploits in a laboratory after prompting the model, and Anthropic observed no real-world exploitation. Anthropic has identified the model only as an unreleased internal research model and has not said whether it will release it.

The Chrome proof of concept combined four flaws: V8 heap corruption, a V8 sandbox escape, a CacheStorage race condition, and a FedCM use-after-free for sandbox escape. It overcame address space layout randomization, a defense that scrambles where code sits in memory, and gained complete control of the renderer process through a return-oriented programming chain, a technique that strings together existing code snippets to run attacker-chosen commands. In one demonstration, the exploit launched the Calculator app on a standard Mac seconds after a page loaded, with no further clicks required from the user.

Anthropic told Google about 62 Chrome flaws that received CVE assignments, and Chrome 156 fixed them, each rated critical or high. The fixes included 13 sandbox escapes and 21 vulnerabilities that could compromise the renderer, the part of the browser that handles web content. Chrome 156 release notes dated Oct. 20 credit Xinyang Ge of Anthropic, assisted by Claude, for selected fixes, though not for all 62. AI Chat Daily counted 23 critical or high fixes in the most recent three Chrome releases that mention Anthropic or Claude, below Anthropic’s stated figure of 62.

The Safari chain never executes code; it captures extensive read and write access to browser memory and then disables the same-origin policy, the rule that keeps one website from reading another’s data. Once a malicious site disables that rule, it can access a user’s history and cookies and send authenticated requests elsewhere. Anthropic describes the Safari attack as data-only, relying on full memory read and write access to modify values rather than executing code. The chain modifies a security flag, an object size and a URL, and several weaknesses constitute intended behaviors exploitable only in combination.

Apple fixed the Safari chain’s use-after-free in iOS and iPadOS 26.5.2 and credits Milad Nasr and Nicholas Carlini with Claude, Anthropic. Apple’s iOS and iPadOS 26.5.2 notes from June 29 credit Milad Nasr and Nicholas Carlini, working with Claude, for the fix. The public record tracks the Safari WebKit use-after-free as CVE-2026-43715. Apple acknowledged Anthropic’s Safari report the same day Anthropic submitted it and implemented a fix promptly.

The Android exploit extracted photos and personal data from a locked Google Pixel 9 over USB. It chained three flaws bypassing USB data transfer restrictions, device-to-device authorization, and six-digit pairing verification. The bypass skipped six-digit verification by behaving as if the user tapped Allow and used a fallback path sending raw file bytes over USB past a hardcoded check. The work combined source code analysis of open-source Android components, reverse engineering and deobfuscation of Google Play services binaries, and live testing on a physical Pixel 9.

Google has addressed the Android issue, yet no public Google document confirming the fix has emerged.

The Windows chain is a remote denial of service where a few packets crash a machine handling HTTP/3, a web transport protocol, requests. Repeated packets keep the machine down, and the attack does not run code or access stored data. Anthropic describes the issue as an out-of-bounds read located in the Windows kernel’s implementation of QUIC, a transport-layer network protocol. Claude found the flaw through binary analysis using tools such as Ghidra, a reverse-engineering tool, after receiving a Windows executable, and Anthropic asked it to reverse-engineer the software, write an annotated C program, compare it to the binary, and study the code for vulnerabilities; when asked to find higher-risk issues, the model surfaced this flaw.

Microsoft fixed the issue as CVE-2026-33096, rated 7.5, though the public record names HTTP.sys rather than QUIC. The public CVE record credits no finder. Microsoft fixed the issue in April. Anthropic estimates several million servers listening on the internet could be exposed to the Windows crash.

As of late October, U.S. government vulnerability enrichment marked CVE-2026-33096 as not exploited and absent from the CISA catalog.

The Linux exploit allows a remote attacker to run commands as root over a network without credentials on servers running a multipath TCP listener (multipath TCP sends data over several network paths). The underlying bug is a race-condition use-after-free in the kernel networking stack. A lost race fails only the handshake without crashing the system, so an attacker can retry indefinitely.

Anthropic ties the Linux bug to CVE-2026-98432, a kernel use-after-free rated 9.8, patched upstream on October 15. The flaw received an upstream patch and backports to every maintained stable kernel branch. The public CVE entry describes an IPv4 TCP fix, not multipath TCP, so the claimed connection relies on Anthropic’s post.

In the proof of concept, leaking a kernel pointer required 48 minutes, and reaching command execution required five more minutes. The exploit leaks a kernel pointer to defeat KASLR, a defense that randomizes the location of kernel code, then overflows a buffer and overwrites a callback pointer with a staged payload that chains kernel functions to run an attacker-chosen shell command as root.

Under Anthropic’s coordinated disclosure policy, vendors get 90 days to patch and another 45 days before the company discusses details past a public advisory. Anthropic told each affected vendor about every flaw before disclosure, and says all are now patched. The company carried out the vulnerability research over several months in test environments.

Anthropic’s Frontier Red Team described five attack chains in a research post published October 27, 2026. Nicholas Carlini, David Dworken, Xinyang Ge, Ben Morris, Milad Nasr, Chris Rohlf and Luna Tong signed the post.

Anthropic frames the research as help for defenders, arguing that strong models let security teams patch systems before attackers do. The company says the central claim is that a single model merged separate flaws into a functioning exploit, a task once limited to small specialist teams. It frames the disclosures as proof that AI can assist researchers in finding and patching vulnerabilities ahead of attacker exploitation. Anthropic’s stated reason for publishing is that models can now build functioning exploits that anyone can execute and verify with little human involvement.

Anthropic said, “Now, it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.”

The company says the effort required only initial prompting and minimal human involvement, and it did not detail what a person did at each step. The degree of model autonomy in building the chains cannot be independently verified because Anthropic does not detail the human work at each step. Anthropic’s report does not state false-positive rates, the total vulnerabilities found, or the time per finding.

Anthropic expanded its Cyber Verification Program to give vetted professionals access to Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. The company also released a Claude Code security plugin for scanning code at pull-request time. It says scaling test-time compute and using diverse scanners increases the vulnerabilities found.

Anthropic built a platform running scanning agents in parallel, measuring each by unique vulnerabilities contributed and tracking coverage across the codebase. The company performed automated variant analysis on each confirmed finding and sent every finding through a standard verification and risk rating process. Also, Anthropic reported local privilege escalation bugs affecting OpenBSD, FreeBSD and Linux, plus sandbox escapes and flaws in web applications.

Anthropic advises defenders that scanning their own code is more important than ever. The company links to a voluntary vulnerability search service for open-source projects alongside the expanded Cyber Verification Program. Anthropic says the affected software could affect billions of users and serves as a bellwether, indicating how models handle vulnerability research and cyber capabilities.