Anthropic's unreleased Claude model chains flaws into working Chrome, Safari, Android, Windows and Linux exploits
Anthropic's Frontier Red Team says an unreleased, internal Claude research model found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into five working proof-of-concept exploits with little human involvement. Google assigned and fixed 62 CVEs from the Chrome work alone. Every flaw was reported to the vendor first, the exploits were built in the lab, and no real-world attacks have been seen.
Finding a single bug in a web browser is hard. Turning several separate bugs into one working attack that takes over a computer is harder still, and for years it has been the work of a small number of elite teams. On 27 October 2026, Anthropic said one of its AI models has now done it five times. In a research post from its Frontier Red Team, the company describes how an unreleased, internal Claude research model found security flaws in Chrome, Safari, Android, Windows and Linux, and then chained them into working proof-of-concept exploits.
According to Anthropic, the model needed only initial prompting and little human involvement. The company stresses that every flaw was reported to the affected vendor first under its coordinated disclosure policy, and that fixes are out. The exploits were built in the lab. As The Hacker News points out, none of them has been seen in a real attack.
The three things you need to know
1. Chrome: one click, outside the sandbox. The strongest example is a one-click remote code execution chain against Chrome on macOS. A malicious page first corrupts memory in V8, Chrome's JavaScript engine. A second flaw escapes V8's own memory sandbox and takes over the renderer. A race condition in CacheStorage then leaks the memory layout of the more privileged browser process, and a use-after-free bug in FedCM, Chrome's sign-in feature, lets the code run outside the browser sandbox entirely. Anthropic's proof of concept opens the Calculator app on a Mac within seconds of the page loading. Anthropic says 62 flaws from this work were assigned CVEs and patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes.
2. Safari and Android: your data, not just your device. The Safari chain never runs code at all. It is a data-only attack that gains read and write access to the browser's memory and then flips a single value to switch off the same-origin policy, the rule that keeps one website from reading another site's data. With that rule gone, a malicious page could read a user's history and cookies and act inside sites where the user is signed in, such as an email account. Apple fixed the central flaw and credits Anthropic researchers "with Claude". The Android chain targets a stolen, locked phone: tested on a Pixel 9, it combines three bugs to get around the lock and copy photos and other data over USB without the six-digit code. Anthropic says Google has fixed it.
3. Linux and Windows: servers too. The most serious chain by impact is on Linux. It gives an attacker a root shell over the network with no login and no user action, as long as the server runs a multipath TCP listener. Anthropic ties it to CVE-2026-98432, a race-induced use-after-free that is patched upstream and backported. Its proof of concept took 48 minutes to leak a kernel pointer and five more minutes to reach the shell, and a failed attempt does not crash the machine, so an attacker could keep retrying. The Windows chain is narrower: an out-of-bounds read in the kernel's handling of QUIC, the transport under HTTP/3, lets a few packets crash a server again and again. Anthropic estimates there are likely several million such servers listening on the internet. That flaw, CVE-2026-33096, was fixed by Microsoft.
What Anthropic actually claims
The interesting part of this report is not any single bug. Browsers and operating systems get patched for serious flaws every month. The claim is about chaining. A modern browser is built so that one bug is rarely enough: a memory corruption in the JavaScript engine still leaves an attacker inside several layers of sandboxes, address space randomization and process isolation. To get from "a page loaded" to "code runs on your computer", an attacker needs a series of bugs that fit together, plus the engineering to make them reliable.
Anthropic says that until now this was the work of a few specialist teams. In its own words, it is now "something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify." The working exploit is the point. A model that lists possible bugs produces a lot of noise. A model that hands over a proof of concept that opens Calculator on a stock Mac gives defenders something they can check in seconds.
The five chains at a glance
- Chrome: runs code outside the browser sandbox after one click or page load on macOS. Fixed as of Chrome 156, with 62 CVEs.
- Safari: lets a malicious page read data from other sites where you are signed in. Fixed by Apple in iOS and iPadOS 26.5.2.
- Android: copies photos off a locked, stolen phone over USB. Fixed by Google, according to Anthropic.
- Windows: crashes a server that answers HTTP/3 again and again. CVE-2026-33096, fixed in April.
- Linux: gives a root shell over the network on servers with a multipath TCP listener. CVE-2026-98432, fixed on 15 October.
What we can and cannot verify
Some of this can be checked independently, and some cannot. The Hacker News notes that Google's Chrome release notes credit "Xinyang Ge of Anthropic, assisted by Claude" for specific fixes, though not for all 62, and that Apple credits "Milad Nasr and Nicholas Carlini with Claude, Anthropic" for the Safari fix in iOS and iPadOS 26.5.2. Those vendor credits are public.
Other parts rest on Anthropic's own account. The company does not name the model beyond calling it an unreleased, internal research model, and it does not break down which steps a human did. The Hacker News also points out that the public CVE records for the Windows and Linux bugs describe the affected components somewhat differently from Anthropic's post. The Windows record names HTTP.sys and credits no finder, and the Linux record describes an IPv4 TCP fix. That does not make the claims wrong, but it means readers are taking part of the story on trust.
Responsible disclosure, by the numbers
Anthropic says it reported every flaw under a coordinated disclosure policy that gives developers 90 days to ship a patch, plus another 45 days before it discusses technical details beyond a public advisory. That gap matters: it gives users time to update before the recipe becomes widely known. It also explains why some of these fixes are months old. The Safari fix shipped in June, the Windows fix in April, and the Chrome and Linux fixes landed in October.
Why it matters
For defenders, the message is uncomfortable but useful. If a model can find and chain bugs like this, attackers with similar models will try to do the same, and the time between a bug existing and a bug being exploited may shrink. Anthropic's answer is to put the capability in defenders' hands first. It recommends scanning code for vulnerabilities as early as pull request time, points to its publicly released Claude Code security plugin, and says it has expanded its Cyber Verification Program, which gives vetted security professionals access to Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 for this kind of work.
For everyone else, the practical advice is old and boring, and it works. Keep Chrome, Safari, your phone and your servers updated. Every chain in this report is already patched, so the people at risk are the ones who never install updates. If you run Linux servers that use multipath TCP, or Windows servers that answer HTTP/3, check that the October and April fixes are in place.
There is also a policy question underneath. Anthropic chose not to release the model that did this work. That is a reasonable call for a tool that can produce working exploits, but it means the most capable systems for offensive security research are now being held back by the labs themselves, with access decided case by case.
Dany's take
This is the moment many security people expected and few wanted to see this early. Finding bugs with AI was already happening. Chaining them into a reliable exploit was supposed to be the hard, human part. Anthropic's report says that wall is getting thin. I am glad the work went to vendors first and that every chain is patched, and I like that the company published a proof you can check instead of a vague benchmark. But I would still like to see a clearer breakdown of what the model did alone and what the humans did. Until then, the best response is simple: update everything, and expect your software to be tested by AI from both sides.
What to watch next
Watch for more vendor credits that mention Claude or other AI models, and for whether rival labs publish similar exploit chain results. It will also be worth seeing how many security teams join Anthropic's expanded Cyber Verification Program, and whether regulators start asking how labs decide who gets access to models this capable.
Should AI labs keep models like this locked away, or release them to defenders? Tell us what you think on our social channels.
Sources
- Anthropic Frontier Red Team: Discovering and exploiting vulnerabilities in critical, real-world software with Claude
- The Hacker News: Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
- Notebookcheck: Anthropic's secret AI extracts data from a locked Android phone and escapes the Chrome sandbox
Source: Anthropic